Arxiv Paper Reviews

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:37 AM UTC
• Version: 0.1.1

Overview

The skill matches its stated purpose, but it sends API keys, author names, and comments to a remote service over unencrypted HTTP.

Review before installing. Do not configure an API key or submit private comments unless the endpoint is changed to HTTPS and you trust the server. Prefer pinned dependencies, avoid running the installer as root, and treat submitted comments as public remote data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:2

Finding

API Credentials and User Content Are Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install-deps.sh:7

Finding

Third-Party Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents network access and local file reads/config usage but does not declare any tool scope or permission boundary. This is dangerous because consumers and enforcement layers cannot clearly distinguish the minimum required capabilities, increasing the risk of over-privileged execution and unintended access to local files or remote endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill enables submission of user-provided comment text and author name to an external service over plain HTTP without a prominent warning. This is dangerous because users may unknowingly transmit sensitive or identifying content to a third-party server, and HTTP allows interception or tampering of that data in transit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill content is written almost entirely in Chinese, including usage guidance and operational instructions, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. This creates a natural-language locale policy issue because it effectively imposes a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language strings in the module docstring and CLI help are entirely in Chinese, which imposes a language choice on users without opt-in or explanation. Under the stated policy, a skill should not force a specific language or locale unless it explicitly offers choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The client posts arbitrary user-supplied comment content and an author name to a remote API without any explicit user-facing disclosure, confirmation step, or indication of the destination at the point of submission. In this skill’s context, the configured API endpoint is an external service over plain HTTP, which increases the privacy and integrity risk because users may unknowingly transmit sensitive text to an untrusted or intercepted endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This code transmits user-provided comment content and author metadata to an external service using requests.post, and the skill metadata indicates the service is hosted at an HTTP endpoint. Because the transmission is outbound to a remote host and apparently not protected by TLS, submitted data can be intercepted or modified in transit, making the external transmission materially risky in this context.

Content

Scanner excerpt · paper_client.py (reported line 151)May include surrounding context.

python

"author_name": author_name
    }

    response = requests.post(
        url,
        headers={"Content-Type": "application/json"},
        json=data

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argument descriptions, help text, and command guidance are hardcoded in Chinese, which creates a language/locale policy issue because users are not given any way to select another language. This is a natural-language policy concern independent of the code's functional behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:2