ClawHub
Back to skill

Security audit

arxiv-survey

Security checks for vulnerabilities and agentic risk

Overview

This skill is a low-risk arXiv report helper, though its documentation overstates what the included script actually does.

Install only if you are comfortable with a shell script making arXiv API requests and writing Markdown files. Expect a basic report stub, not a complete categorized Chinese-translated survey, unless the agent performs additional work after the script runs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior materially differs from the implemented behavior, including missing categorization, translation, and structured content generation. Security-wise, this undermines user trust and reviewability: users may approve execution believing the skill performs only benign survey/reporting steps while the actual code path does something narrower or different, making misuse or hidden side effects harder to detect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes user-facing natural language that fixes the output language to Chinese. The policy requires flagging skills that force a specific language or locale without user opt-in, and the README presents Chinese translation as a mandatory feature rather than an option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow section describes Chinese translation as an automatic processing stage for all runs. This is a natural-language locale policy issue because the skill appears to enforce one language output without presenting user choice or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The wording 'All paper abstracts are translated to Chinese' indicates the skill forces a specific language for generated content. Because no opt-in, toggle, or regional justification is provided, this matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 198)May include surrounding context.

Install curl:

bash
# Ubuntu/Debian
sudo apt-get install curl

# macOS
brew install curl

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 204)May include surrounding context.

Install curl:

bash
# Ubuntu/Debian
sudo apt-get install curl

# macOS
brew install curl

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 211)May include surrounding context.

Install curl:

bash
# Ubuntu/Debian
sudo apt-get install curl

# macOS
brew install curl

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises shell-backed behavior via an external script but does not declare any tool scope or allowed-tools restrictions. That omission can cause the runtime to grant broader-than-expected execution capability or make review and policy enforcement harder, which increases the risk of command execution beyond the intended arXiv-survey task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description states that the skill 'translates abstracts to Chinese' as a built-in behavior, which imposes a specific output language by default. This is a natural-language locale policy concern because no user opt-in or alternative language option is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow explicitly says 'Translate abstracts to fluent Chinese,' indicating a fixed language requirement rather than a user-selected preference. This violates the language-choice criterion unless the locale restriction is documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The comment explicitly states "English only, no Chinese chars," which is a natural-language locale/language restriction. Under the policy, forcing a specific language without user choice or a clear justified regional constraint is a reportable violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Comments and messaging describe a year-to-present survey, which implies broader coverage across the requested time range. The implementation instead queries a single page capped at 50 results and processes only the first 20 entries, so the documented intent is materially broader than the actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest says the skill automatically categorizes papers, translates abstracts to Chinese, and generates a structured report. In this code, the generated report contains only placeholder text such as 'Categories and papers will be auto-generated' and 'Paper details with Chinese abstracts will be listed here', with no logic that categorizes papers or translates abstracts.

Content

No source excerpt is available for this finding.