Security audit

axiv-html-cn-static

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent arXiv-to-local-HTML purpose, but its downloader and generated HTML handling expose users to avoidable network and active-content risks.

Review before installing. Run it only in an isolated virtual environment or container, avoid sensitive networks, and inspect generated HTML before opening or sharing it. Prefer a version that pins dependencies, restricts downloads to trusted arXiv HTTPS hosts with size limits, sanitizes embedded figure/table HTML, and uses local MathJax or an explicit CDN opt-in.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/arxiv_html_static_builder.py:128
Finding: Unrestricted Asset Retrieval Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/arxiv_html_static_builder.py:242
Finding: Unsanitized Remote Figure and Table Markup Is Embedded into Generated HTML
Content: View full analysis
"] for fig in figures: label = fig.get("label") or fig.get("id", "figure") parts.append(f'
') embedded = fig.get("html") if embedded: parts.append(embedded) else: parts.append("") for src in fig.get("images", []): parts.append(f' ...[truncated 2906 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:1
Finding: Open-Ended Dependency Versions Produce Non-Reproducible and Unreviewed Installations
Content: View full analysis
=2.28.0 beautifulsoup4>=4.11.0 ``` The documented workflow instructs users to install these requirements: ```bash python3 -m pip install -r scripts/requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. An installation can therefore select any future release satisfying the lower bound rather than a version reviewed with this Skill. The package names are legitimate, and the audited files contain no evidence of dependency confusion, typosquatting, or an intentionally malicious package. Nevertheless, the configuration creates a supply-chain and reproducibility weakness: the effective code executed during installation and at runtime can change after the Skill itself has been audited. A compromised upstream release, compromised package-index account, or incompatible future release could consequently affect users without any change to this repository. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver queries the configured Python package index. 3. It selects the latest releases satisfying the open-ended constraints. 4. If a selected release is compromised or introduces unsafe behavior, its installation or imported code executes in the user's environment. 5. The Skill then runs with the privileges of the invoking user. This is a conditional supply-chain path rather than evidence that the currently named dependencies are malicious. ### Impact Assessment A compromised dependency could obtain the same privileges as the Python process, potentially allowing it to: - Read or modify files accessible to the invoking user. - Access environment variables and process credentials. - Make arbitrary network requests. - Alter generated documents or assets. - Execute additiona ...[truncated 231 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly directs package installation, network fetching from arXiv, and creation of local output files, but it declares no explicit tool scope or permissions boundary. That increases the chance an agent will invoke network and filesystem actions without clear user awareness or policy gating, which is a real security and transparency problem even though it does not by itself prove malicious intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description focuses on conversion functionality but does not prominently warn that it downloads remote content and writes a local directory tree containing HTML, assets, and metadata. In agent settings, missing disclosure of network and file-modifying behavior can lead to unexpected data transfer or filesystem changes without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented commands instruct pip installation and execution of a downloader/builder script without an explicit warning that they will modify the local environment and access the network. Installing dependencies and running scripts are sensitive actions that can change the host state, introduce supply-chain risk, and surprise users if not clearly disclosed and consented to.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill promises a local/offline static HTML result but states that formula rendering uses the MathJax CDN by default. This creates a hidden remote dependency that can leak access metadata, break offline use, and undermine the trust model of a supposedly self-contained local artifact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document says external CDNs should not be a necessary dependency, yet earlier it makes a CDN the default for formula rendering. This inconsistency is dangerous because operators may believe output is offline-safe when it still depends on third-party infrastructure, creating avoidable privacy, integrity, and availability risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file repeatedly requires the generated artifact to be in Chinese, including the title and content requirements for a Chinese static HTML page and Chinese body text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file description states the script builds a Chinese static HTML page, and the implementation later hard-codes Chinese language output and labels rather than offering a language choice. This is a natural-language locale policy concern because the skill forces a specific language experience without explicit user opt-in or configurable alternatives.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The asset downloader follows whatever URLs appear in source HTML/CSS and fetches them without restricting hostnames or schemes beyond a few trivial skips. A malicious or unexpected paper page could cause requests to arbitrary external servers, leaking the operator's IP/network metadata and importing untrusted content into the local build.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated document sets lang="zh-CN" and includes fixed Chinese title/meta text such as '中文静态版' and '本地中文静态 HTML'. Because the skill does not provide a user-selectable locale, it enforces a specific language setting in generated output.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated 'static' HTML loads MathJax from jsDelivr at runtime, which means opening the page causes a network request to a third-party CDN and executes remote JavaScript. That breaks the local/offline trust model and creates a supply-chain/privacy risk if the CDN is unavailable, compromised, or blocked.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency specification uses a minimum version bound instead of pinning to an exact version, which makes builds non-reproducible and can result in different environments installing different releases. In a supply-chain context, this increases exposure to accidentally pulling a vulnerable or incompatible version of requests, especially given the package's history of advisories.
Content: Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0 beautifulsoup4>=4.11.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest includes requests without pinning a specific version, and the package has multiple known advisories across its release history. Because the installed version is not fixed, there is no assurance that deployments will avoid affected releases, which creates a real supply-chain risk for a network-facing HTML retrieval/conversion skill that likely fetches remote arXiv content.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: beautifulsoup4 is also unpinned, so installations may resolve to different versions over time. While this is usually a hygiene and supply-chain hardening issue rather than an immediate exploit, it weakens reproducibility and makes it harder to verify exactly what code is being deployed.
Content: Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.
text
requests>=2.28.0 beautifulsoup4>=4.11.0