Security audit
Security checks for vulnerabilities and agentic risk
This academic mentoring skill is purpose-aligned and disclosed, with ordinary cautions around optional installs, research privacy, PDF handling, and user-approved exports.
Before installing, be aware that optional OCR/PDF dependencies may require system package installation, and do not share confidential research ideas, unpublished PDFs, or personal academic profile details with external integrations unless you understand where the data goes. Confirm file paths before asking the agent to save or export materials.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install tesseract ghostscript poppler
sudo apt-get install tesseract-ocr poppler-utils ghostscript
### Basic Usage
The README promotes literature analysis and advisor matching features that may reasonably involve sending user queries, research ideas, or profile data to external academic APIs or databases, but it does not warn users about that data flow. In an academic context, unpublished research topics, draft questions, and advisor preferences can be sensitive and disclosure could expose intellectual property or personal information.
The README instructs users to parse local PDF papers without warning that the files may contain sensitive unpublished manuscripts, reviewer comments, or proprietary research data. If PDF processing uses external services, logs contents, or stores extracted text insecurely, users may unknowingly expose confidential academic material.
The activation criteria are very broad and cover common academic-assistance requests, so the skill may be invoked in situations where the user did not intend to use a specialized agent. That increases the chance of unnecessary collection of detailed project information and accidental execution of downstream behaviors such as proposal generation or advisor matching under the wrong context.
The skill instructs the agent to offer saving generated content to a file without warning the user that this may create or overwrite local files. In an agent environment with filesystem tools, this can lead to unintended persistent changes, surprise file creation, or overwriting user data without sufficiently informed consent.
Encouraging export of results to files without a warning about filesystem effects creates a risk of silent persistence of generated materials. Even if the content is benign, the operational behavior is security-relevant because it can modify the local environment in ways the user did not clearly authorize.
Telling the agent to offer saving or exporting materials, while omitting any requirement for user warning or confirmation, creates a direct path to unauthorized file creation or overwriting. In practice, this is especially risky because users may interpret an 'offer to save' as harmless while the agent may have tool access to make persistent changes.
No suspicious patterns detected.