Security audit

results-vocabulary-lexis-advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent academic writing advisor, but one bundled reference PDF contains under-disclosed active JavaScript content.

Review this package before installing if your agent or PDF viewer may process bundled PDFs with JavaScript enabled. The markdown skill itself is narrowly scoped, but the Posner & Petersen PDF should ideally be sanitized or handled with PDF JavaScript disabled.

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ��S��r��X*��+��F�LA2��&�/s��{��ّ �uQ�7]��4 �즉?-٦^�3�(�2h2W}��ZEr�U�P�T��֯�:TO�A?4�-�i~��1u�'�",|�� P�X�n�T�%��tv:��h[0[e�d��DTn+苨��J3�f9&��?�K �k K�y+j �xċ�yUۓ=�F��CI�(��r� �:&��@S�gi��RԘy��g\��
Confidence: 89% confidence
Finding: Unlike the other TM1 hits, this file does contain an actual active element: an embedded OpenAction JavaScript object that executes app.execMenuItem('ShowHideBookmarks') on open. Even though the script is benign in effect, active document-triggered JavaScript is dangerous in agent or automated document-processing contexts because it normalizes executable content inside inputs and can be swapped for more harmful actions in similar workflows.

Static analysis

No suspicious patterns detected.