Security audit

Papyrus

Security checks for vulnerabilities and agentic risk

Overview

Papyrus has a coherent paper-to-PDF purpose, but its scripts process untrusted paper content and user paths in ways that can execute code or leak formula content to third parties.

Install only in a constrained workspace and avoid using it on private or sensitive papers until the scripts are fixed. Prefer local-only formula rendering, review downloaded arXiv sources as untrusted, avoid attacker-controlled paths or filenames, and do not enable the agent adapters in a privileged or credential-rich environment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: SCRIPTS/render_formulas.sh:152
Finding: Arbitrary Python Code Execution Through Formula Content and Output Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SCRIPTS/render_figures.sh:43
Finding: Arbitrary Python Code Execution Through Archive-Controlled PDF Filenames
Content: View full analysis
2000: scale = 2000 / pil_img.width pil_img = pil_img.resize( (int(pil_img.width*scale), int(pil_img.height*scale)), Image.LANCZOS) pil_img.save('$out') print(' $base: {}x{} (embedded bitmap)'.format(pil_img.width, pil_img.height)) sys.exit(0) except: pass mat = fitz.Matrix(200/72, 200/72) pix = page.get_pixmap(matrix=mat) pix.save('$out') " if [ -f "$out" ]; then OK=$((OK + 1)) sz=$(python3 -c "import os; print(os.path.getsize('$out'))") echo " $sz bytes" fi done ``` ### Technical Analysis The values `pdf_file`, `out`, and `base` can be influenced by filenames inside the downloaded paper archive. They are inserted directly into Python string literals and statements passed to `python3 -c`. Unix filenames may contain single quotes, line break ...[truncated 1441 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SCRIPTS/build_pdf.sh:26
Finding: Arbitrary Python Code Execution and Unrestricted Resource Loading During PDF Generation
Content: View full analysis
`, stylesheet, font, or other resource reference to a local file or network endpoint. 2. Papyrus passes the HTML directly to WeasyPrint. 3. WeasyPrint resolves the referenced resource using the host's filesystem and network context ...[truncated 572 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: platforms/codex/papyrus-tool.yaml:19
Finding: Shell Command Injection in Codex Tool Definitions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: platforms/open-code/papyrus-config.yaml:17
Finding: Shell Command Injection in Open Code Tool Definitions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SCRIPTS/fetch_arxiv.sh:28
Finding: Unsafe Extraction of Untrusted arXiv Source Archives
Content: View full analysis
/dev/null || true ``` ### Technical Analysis The script extracts a network-provided archive directly into the work directory without first inspecting its members. It does not explicitly reject absolute paths, parent-directory traversal components, symbolic or hard links, device entries, or unexpectedly large archives. Some modern `tar` implementations apply partial traversal defenses, but behavior varies by implementation and does not replace explicit validation. Unsafe links and resource-exhaustion archives remain relevant concerns. The command also suppresses extraction errors with `2>/dev/null || true`. This allows the workflow to continue after a partial or suspicious extraction, leaving attacker-controlled files available to later processing. Crafted names can directly amplify the Python-injection vulnerability in `render_figures.sh`. ### Attack Path 1. An attacker supplies or controls a paper source archive. 2. Papyrus downloads the archive from the expected arXiv endpoint. 3. The archive contains malicious paths, links, special entries, excessive data, or crafted filenames. 4. The script extracts it without pre-validation. 5. Depending on the local `tar` implementation and archive structure, extraction writes unexpected entries, consumes excessive resources, or prepares malicious files for later processing. 6. Extraction errors are ignored, so subsequent workflow stages continue against a potentially unsafe partial tree. 7. A crafted PDF ...[truncated 506 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · TEMPLATES/paper.html (reported line 10)May include surrounding context.
html
<meta name="description" content="{{PAPER_SHORT_DESC}}"> <meta name="keywords" content="{{PAPER_KEYWORDS}}"> <meta name="generator" content="Papyrus"> <!-- Design system adapted from Kami (docs.openclaw.ai) Colors, spacing, font stacks, and wireframe patterns used under MIT license.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The fallback to codecogs.com means formula contents may be sent to an external third-party service, yet the skill gives no warning or consent step. Papers, drafts, or user-provided formulas can contain unpublished, proprietary, or sensitive material, so undisclosed exfiltration to a third party creates a meaningful confidentiality risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L19 requires a Chinese translation as part of the review checklist, which imposes a specific language/locale outcome. The file does not indicate that this is optional, user-selected, or justified as a region-specific requirement, so it conflicts with the language/locale policy rule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states that formulas may be rendered via codecogs.com, which implies transmitting paper-derived content to a third-party service. Even if the content is 'just formulas,' academic manuscripts can be unpublished, proprietary, or sensitive, and the documentation does not clearly warn users that content may leave the local environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When local rendering is unavailable, the script sends the full LaTeX formula to latex.codecogs.com. If formulas contain proprietary, sensitive, or user-supplied data, this creates an external data disclosure path to a third party, which is risky given the skill context does not establish that network transmission is expected or approved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The online fallback silently transmits formula contents to a third-party service without an explicit warning or consent step. Even if the formulas seem harmless, user input may include confidential research, internal notation, or embedded secrets, making the undisclosed disclosure a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sets LANGUAGE="zh-CN" as the default locale, and the usage text repeats that default. This imposes a specific language choice unless the user explicitly overrides it, which is a natural-language locale policy concern when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file describes the output as inherently bilingual and specifically includes Chinese translation, and L11 further specifies paragraph-by-paragraph Chinese translation. Because this language behavior is presented as mandatory rather than optional, it may violate language/locale policy unless users are given a choice or the Chinese-only requirement is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly states that commentary is enriched by web research and also downloads from arXiv and codecogs, but it does not clearly frame these as external network requests triggered by user-supplied paper inputs. This can leak sensitive user interests, internal document content, or derived queries to third-party services, especially when local PDFs or proprietary papers are processed under the same workflow assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The SOP explicitly permits falling back to an online rendering service for formulas, which sends formula content to a third party without requiring user notice, consent, or data classification checks. In a paper-processing workflow, formulas may contain unpublished research, proprietary notation, or sensitive technical content, so this creates a real confidentiality and supply-chain exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document hard-codes bilingual output with a Chinese translation block and Chinese figure/formula captions, and the table guidance also requires bilingual headers. Although output preferences earlier mention confirming language, these later mandatory instructions enforce a specific locale rather than clearly making it optional based on user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTML root sets lang="zh-CN", and the template consistently uses Chinese-only visible labels such as 逐段精读, 原始论文, and 编译说明. Because this file is a general template and does not provide any opt-in or alternative locale handling, it appears to impose a specific language/locale in a way that conflicts with the stated policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs fetching content from arXiv and conducting web research, but it does not disclose that using the skill will trigger external network access. This can surprise users, violate least-surprise/privacy expectations, and cause data-handling or policy issues in restricted environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description mandates a specific bilingual English and Chinese output format rather than offering language selection. This can violate language/locale policy expectations because the skill forces a particular language combination without documented user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest advertises network access, archive extraction, file conversion, and output writes, but does not warn users about those side effects or constrain destinations. In an agent setting, this can lead to unexpected downloads, processing of untrusted paper sources, and filesystem modifications, increasing the chance of unsafe handling of attacker-controlled content or surprising system changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly says the skill produces output with EN→CN translation, which imposes a specific language transformation by default. There is no indication that users can opt in to Chinese output, select another locale, or that the language restriction is required for a documented region-specific purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The tool is presented as a paper-processing utility, but its core behavior is to execute a local shell script via bash from a user-writable home-directory path. In an agent-tool context, that increases risk because the effective behavior depends on external script contents that are not visible here, creating an opaque execution boundary that could perform arbitrary actions on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The _run method invokes a bash subprocess to execute an external script, which is a safety-relevant operation for code files. While the docstring says it executes a CLI command, there is no visible confirmation prompt, logging, or warning to the user that shell execution will occur.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · platforms/hermes/papyrus-tool.py (reported line 31)May include surrounding context.
python
def _run(self, *args, timeout: int = 300) -> str: """Execute a papyrus CLI command.""" cmd = ["bash", self.cli, *args] result = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout ) if result.returncode != 0:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The tool provides commands that write extracted sources, generated PNGs, and output PDFs to user-specified directories and files, but the code offers no confirmation prompt or user-facing disclosure at the point of execution. Although the docstrings describe outputs, they do not clearly warn that these methods will create or overwrite filesystem contents in the supplied paths.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module exposes a generic command-dispatch interface driven by user input, which broadens the accessible surface beyond the documented safe operations. In a tool/agent ecosystem, this is more dangerous because external orchestrators may treat the interface as trustworthy and pass through attacker-influenced command names, enabling invocation of unintended methods.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description states that the tool produces a bilingual PDF with an English original plus Chinese translation, which implies a fixed language choice. Under the policy, forcing a specific language or locale without user opt-in is a violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This manifest defines multiple runnable commands and a workflow that downloads content, extracts files, converts assets, and builds output files under user-supplied paths, all via shell-style run strings. While these operations are central to the tool, the manifest provides no explicit warning, confirmation, or user-facing disclosure about filesystem changes, downloads, or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list uses natural-language descriptions such as "User asks to deep-read or annotate a paper" and "User provides an arXiv URL" without clear constraints or exclusion conditions. These broad conditions could cause the skill to activate for ordinary paper-related conversations, not just explicit requests to run this pipeline.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The pipeline explicitly downloads external arXiv content and later delivers generated output, but the manifest contains no user-facing notice or consent step about network access, remote content retrieval, or handling of potentially sensitive URLs and derived files. This can lead to unexpected external requests, privacy surprises, and processing of untrusted remote content without transparent user awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.