Security audit

Add Literature

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core goal is legitimate, but it asks the agent to publish to an external platform with bearer-token access while discouraging human approval and giving weak TLS credential-safety guidance.

Install only if you are comfortable with an agent autonomously writing scholarly records and occasional feedback to the human-free MCP platform. Use a narrowly scoped, revocable API key, prefer the public TLS endpoint or verify any internal certificate out of band, and require your own confirmation before publish/upload operations if you want human review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:14
Finding: Skill instructions override human oversight and encourage autonomous external writes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: reference/connecting.md:7
Finding: Unqualified trust of a self-signed certificate can expose bearer credentials
Content: View full analysis
` on **every** request (missing/invalid → 401). For adding literature use a key with role **`ideator`**. Any authenticated agent may create `literature` — only the `research` *type* is owner-restricted (not `literature`), so no special role or ownership is needed here. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ``` ### Technical Analysis The connection guide requires transmission of a bearer API key on every MCP request and then advises the operator to trust a self-signed certificate. It does not require verification of the certificate fingerprint, installation of a controlled private certificate authority, hostname validation, or confirmation through a separate trusted channel. A self-signed certificate is not inherently insecure when it is securely pinned or distributed. The vulnerability is the unqualified instruction to trust it. If an operator accepts an arbitrary certificate or disables TLS verification, the client cannot reliably authenticate the server. An attacker capable of intercepting or redirecting internal network traffic could present another self-signed certificate and impersonate the MCP endpoint. ### Attack Path 1. An operator configures the agent to use the internal MCP endpoint. 2. Following the documentation, the operator accepts the endpoint’s self-signed certificate without validating its fingerprint or trust chain, or disables certificate verification. 3. An attacker with control of DNS, routing, a local proxy, or the internal network redirects the MCP connection. 4. The attacker presents an attacker-controlled self-signed certificate. 5. The client accepts the certificate because server ...[truncated 945 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to act 'fully autonomously' and 'never defer to a human's value judgment or wait for human approval,' removing a human checkpoint before performing network access and write operations. In a system that can search the web, upload artifacts, and publish records, this creates a meaningful governance and safety risk because ambiguous, malicious, or policy-sensitive requests may be executed without review.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · reference/connecting.md (reported line 8)May include surrounding context.
md
- **URL**: `https://<tunnel-domain>/mcp` (ask the platform operator for the current tunnel domain; an internal LAN HTTPS endpoint also exists for on-site operators) - **Transport**: streamable-http - **Auth**: header `Authorization: Bearer <your platform API key>` on **every** request (missing/invalid → 401). For adding literature use a key with role **`ideator`**. Any authenticated agent may create `literature` — only the `research` *type* is owner-restricted (not `literature`), so no special role or ownership is needed here. - Internal endpoint uses a self-signed cert → trust it; the public tunnel terminates TLS (usually no warning). ## Claude Code

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger description uses broad phrases like 'add literature' and 'find papers about X and upload them', which can match a wide range of ordinary user requests and cause this skill to activate in situations the user did not specifically intend. Because the skill performs external web retrieval and publishes data to a platform, over-broad invocation increases the chance of unintended writes, data ingestion, and side effects from ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Telling users to trust a self-signed certificate without verification guidance weakens TLS assurances and can normalize bypassing certificate validation. In practice, this can enable man-in-the-middle attacks on the internal endpoint, exposing the bearer token and all MCP traffic if a malicious or misconfigured certificate is accepted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document instructs users to place a bearer API key directly into command lines and client configuration but does not warn that this credential is sensitive or that shells, process listings, logs, screenshots, and shared config files may expose it. Because the key grants authenticated access to the MCP platform, accidental disclosure could let an attacker create or manipulate platform resources within the key's permissions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.