Abstract Logic Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:20 AM UTC
• Version: 0.1.1

Overview

The skill mostly matches its abstract-writing purpose, but its optional ontology downloader can fetch arbitrary network or local-file URLs without safeguards.

Review before installing if the agent will have network access. The local linting and scoring parts are straightforward, but avoid running the ontology downloader with untrusted URLs; use only trusted HTTPS ontology sources and inspect generated output before reusing or publishing it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ontology_bootstrap.py:98

Finding

Unrestricted Ontology URL Retrieval Enables SSRF and Local File Copying

Content

View full analysis

Vulnerability Details

File Location: scripts/ontology_bootstrap.py:98-105
Vulnerability Type: Unrestricted URL retrieval
Risk Level: Medium

python

def download_ontology(url: str, outdir: Path) -> Path:
    outdir.mkdir(parents=True, exist_ok=True)
    parsed = urlparse(url)
    filename = Path(parsed.path).name or 'downloaded_ontology.owl'
    destination = outdir / filename
    urllib.request.urlretrieve(url, destination)
    return destination

The vulnerable function is invoked with user-controlled input at scripts/ontology_bootstrap.py:118-121:

python

if args.download_url:
    downloaded = download_ontology(args.download_url, outdir)
    print(f'downloaded: {downloaded}')

Technical Analysis

The --download-url argument is passed directly to urllib.request.urlretrieve without validating the URL scheme, resolved destination, redirects, response size, or returned content. Consequently, an attacker who can influence this argument may cause the process to request resources using the host's network position.

Possible exploitation methods include:

• Supplying an HTTP or HTTPS URL that resolves to a loopback, private, link-local, or otherwise internal address, resulting in server-side request forgery.
• Supplying a file:// URI to copy a local file readable by the process into the selected output directory.
• Supplying an endpoint that returns an excessively large or non-terminating response, consuming disk space or blocking execution.
• Using redirects or DNS resolution changes to bypass superficial hostname checks if incomplete validation is later added.

The URL-derived filename is reduced to a basename, which limits direct path traversal through the URL path. The downloaded content is stored rather than executed, so the finding does not constitute remote payload execution by itself.

Attack Path

1. An attacker provides or induces use of a crafted --download-url.
2. The agent or user invokes the documented on ...[truncated 1365 chars]

Remediation

View remediation

Remediation Suggestions

1. Permit only HTTPS URLs and reject file:, ftp:, data:, and all other schemes.
2. Reject URLs containing embedded credentials or malformed host components.
3. Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IP addresses for both IPv4 and IPv6.
4. Apply the same validation to every redirect target. Prefer disabling automatic redirects and following only validated redirects.
5. Use an allowlist of trusted institutional or official ontology repositories where practical.
6. Replace urlretrieve with bounded streaming retrieval that enforces connection and read timeouts, a maximum response size, and a maximum redirect count.
7. Validate the response content type and parse the result as an expected ontology format before retaining it.
8. Generate a controlled destination filename rather than relying on a URL-derived name, and refuse overwrites unless explicitly requested.
9. Download to a securely created temporary file and atomically move it into the output directory only after validation succeeds.
10. Require explicit user confirmation before network retrieval when the skill is operating through an agent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/source-abstract-corpus.md (reported line 31)May include surrounding context.

md

## 6. LoGe-Planner

Complex aerial operations necessitate the tight coupling of discrete task sequencing and continuous trajectory generation, collectively known as Task and Motion Planning (TAMP). However, the stochastic dynamics and high-density interactions of low-altitude environments often fracture this coupling, leading to brittle solution performance. To reconcile mission dependencies with flight dynamics, we propose {LoGe-Planner}, a multi-tier LLM-collaborative framework bridging logic abstraction with geometric grounding. Recognizing the combinatorial explosion of high-density operations, LoGe-Planner first uses a cloud-hosted Hypotheses-to-Theories (HtT) module to extract context-aware, auditable decomposition rules from exploration traces, and applies them to partition a global mission dependency graph into causality-preserving macro-tasks. This decomposition reduces long-horizon combinatorics while maintaining precedence constraints. An edge-deployed neuro-symbolic TAMP solver then grounds each macro-task into dynamically feasible, geometrically verified trajectories under time-varying resource occupancy. Finally, a terminal Tiny-LLM, parameter-efficiently adapted via LoRA, performs embodied anomaly interpretation from onboard state signals and triggers targeted replanning when environmental or platform conditions deviate from the current plan. Across five simulated urban-operation scenarios with infrastructure bottlenecks and stochastic disturbances, extensive simulations demonstrate that LoGe-Planner maintains a 95\% success rate and reduces planning latency by 3.5 times.

## 7. AirFogSim

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README describes the skill as providing drafting, linting, and scoring specifically for "English academic abstracts." This is a natural-language locale constraint presented as a default behavior, but the file does not indicate that users can choose another language or explicitly opt into the English-only restriction.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to read repository files, write output files, and optionally run a script that can download a public ontology, but it declares no explicit tool scope or permission boundaries. That creates an avoidable overreach risk: an agent may use filesystem or network capabilities more broadly than intended, increasing the chance of unauthorized file access, unintended writes, or external fetches based on user-controlled input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and overview explicitly instruct the skill to write and critique English academic abstracts, but they do not offer a user language choice or explain a justified locale restriction. This is a natural-language policy issue because it imposes a specific language by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.