Security audit

八要素法文献阅读

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed academic paper-reading helper, with manageable caveats around fetching restricted links and saving literature notes.

Before installing, be aware that the skill may fetch paper metadata or abstracts online, read PDFs or paths you provide, and store literature notes in a workspace Markdown file. Ask it not to use local curl for restricted links unless you are authorized to access the source, and confirm where notes should be saved if the papers or reflections are sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The workflow explicitly suggests using local PowerShell curl.exe to fetch restricted links such as WeChat pages. That creates a policy-bypass path and weakens the later ethical constraint about not bypassing access restrictions, making it more likely the agent will retrieve content from access-controlled sources without clear authorization checks.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README tells users to invoke the skill with a very generic phrase ('精读这篇') after sending a paper in many possible forms, which is broad enough to overlap with ordinary conversation. In agent systems that rely on natural-language routing, ambiguous triggers can cause unintended activation, leading the agent to process sensitive documents or URLs when the user did not explicitly intend to invoke this skill.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The skill is presented entirely in Chinese and instructs users with Chinese trigger wording and methodology labels without offering a language-choice fallback. This can cause the agent to respond in an unexpected locale, mis-handle user intent, or reduce transparency for users who cannot read the instructions, which is a quality and safety concern in multilingual environments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to append notes to a persistent literature-notes file, including a default workspace path, without requiring explicit per-write confirmation or a clear persistence warning at write time. This can lead to unintended retention of sensitive research interests, uploaded paper details, or user-authored reflections across sessions.

Static analysis

No suspicious patterns detected.