Security audit

论文查重与 AIGC 报告助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paper-checking helper that can upload user-provided manuscripts to fixed checking services and create unpaid orders, with clear limits against auto-payment, fake reports, and bypassing verification.

Install only if you are comfortable sending selected manuscript files to the configured CQCCJY/Fanyu paper-checking services. Confirm the brand/product before uploads, review any payment page yourself, and do not use the reduction lane to hide plagiarism or evade academic-integrity rules.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly instructs use of a Python script that reads environment configuration, accepts local files, and makes network requests, yet no declared permissions are shown. This creates a capability-transparency gap: reviewers, policy enforcers, or users may not realize the skill can access environment-bound endpoints and upload user documents, increasing the chance of over-privileged or insufficiently governed execution.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file documents rewrite/reduction endpoints that expand the skill beyond its stated plagiarism-checking and report-query purpose. This scope drift is dangerous because an agent may invoke content-rewriting functionality for academic work, enabling policy bypass, misuse for ghostwritten paraphrasing, or user confusion about what the skill is authorized to do.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The contract states that reduction is not plagiarism checking, which conflicts with the skill’s positioning as a paper-check tool. Even though the statement is cautionary, the coexistence of contradictory scope signals can cause the agent to mix verification and rewriting behaviors, increasing the chance of deceptive responses, improper tool selection, or academic-integrity misuse.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger description includes a long list of broad, common phrases such as references to reports, character counts, authenticity checks, and AI rate topics, which could cause the skill to activate in contexts broader than intended. In this skill, unintended activation is more sensitive because the skill can route to file-handling and network-backed workflows involving academic papers and external services.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The workflow trigger text is broad enough that requests related to rewriting, quote estimation, character counting, report upload, and query actions could be routed into this reduction flow without sufficiently clear user intent. In a paper-checking context, unintended invocation can lead to accidental processing of sensitive manuscript content or steering users into plagiarism-reduction behavior they did not explicitly request.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_paper_check_client.py:13