ClawHub
Back to skill

Security audit

figshare-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly transparent Figshare integration, but it needs review because it can publish or upload account content and its downloader writes remote-provided filenames locally without sanitization.

Install only if you need Figshare automation and trust the publisher. Use a Figshare token only when needed, verify article IDs and filenames before uploads or publishing, and avoid downloading from untrusted Figshare articles until filename sanitization is added.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill clearly relies on shell execution (`curl`, `jq`, helper scripts) while declaring no permissions, which creates a transparency and enforcement gap. That makes it easier for a runtime or reviewer to underestimate the skill's ability to transmit data externally, access local files for upload, and perform account-modifying actions.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The README states the skill triggers automatically on broad indicators such as any mention of Figshare, any figshare.com URL, or a Figshare DOI. In agent environments, overly broad auto-invocation can cause the skill to activate in unintended contexts, leading to unnecessary network-capable actions, exposure of account-scoped operations, or user confusion about why a powerful integration was engaged.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The README states the skill will automatically trigger whenever the user mentions Figshare, a Figshare URL, or a Figshare DOI. That is overly broad for a skill that supports state-changing operations like create, update, upload, and publish, because casual discussion of Figshare content could invoke the skill without an explicit request to act. In this context, broad triggering increases the chance of unintended API calls against the user's account when credentials are present.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation prominently advertises create, update, upload, and publish capabilities, but does not clearly emphasize that these modify remote Figshare content and may be difficult or impossible to undo after publication. For a skill tied to authenticated account operations, missing warnings can lead users or host agents to treat destructive or irreversible actions as routine, increasing the risk of accidental publication or unintended content changes.

External Transmission

Medium
Category
Data Exfiltration
Content
### Create an article (draft)

```bash
curl -s -X POST https://api.figshare.com/v2/account/articles \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
78% confidence
Finding
This is the same create-article authenticated write operation already noted above. It is security-relevant because it sends user/account data externally and changes remote state.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# update metadata
curl -s -X PUT https://api.figshare.com/v2/account/articles/$ART \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title": "New title"}'
Confidence
86% confidence
Finding
This is the same update/publish external write behavior already noted above. The publish capability particularly raises the impact because it can disclose content publicly and is difficult to reverse.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
   SIZE=$(stat -f%z "$FILE" 2>/dev/null || stat -c%s "$FILE")
   MD5=$(md5sum "$FILE" | awk '{print $1}')   # or: md5 -q on macOS
   curl -s -X POST https://api.figshare.com/v2/account/articles/$ART/files \
     -H "Authorization: token $FIGSHARE_TOKEN" \
     -H "Content-Type: application/json" \
     -d "{\"md5\":\"$MD5\",\"name\":\"$(basename $FILE)\",\"size\":$SIZE}"
Confidence
90% confidence
Finding
This is the repeated detection of the upload-initiation step. It is dangerous because it enables local file transfer to an external service using authenticated context, which is highly sensitive even when intended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
   dd if="$FILE" bs=1 skip=$START count=$((END-START+1)) 2>/dev/null \
     | curl -s -X PUT --data-binary @- "${upload_url}/${partNo}" \
       -H "Authorization: token $FIGSHARE_TOKEN"
   ```
Confidence
88% confidence
Finding
This command streams raw byte ranges from a local file to an external upload URL, which is a direct data exfiltration capability by design. Although appropriate for multipart upload, it is security-sensitive because any mistake or abuse in file/path handling could transfer unintended local content outside the system boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
ART=12345678
curl -s https://api.figshare.com/v2/articles/$ART/files \
  | jq -r '.[] | "\(.download_url)\t\(.name)"' \
  | while IFS=$'\t' read -r url name; do curl -L -o "$name" "$url"; done
```
Confidence
72% confidence
Finding
This workflow downloads URLs returned by Figshare and writes files using remote-provided names, which introduces risk beyond simple external transmission. If filenames are not sanitized, a malicious or unexpected file name could overwrite local files or create confusing paths, and bulk download from remote URLs increases exposure to untrusted content.

External Transmission

Medium
Category
Data Exfiltration
Content
### Create an article (draft)

```bash
curl -s -X POST https://api.figshare.com/v2/account/articles \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
78% confidence
Finding
This is the same create-article authenticated write operation already noted above. It is security-relevant because it sends user/account data externally and changes remote state.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# update metadata
curl -s -X PUT https://api.figshare.com/v2/account/articles/$ART \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title": "New title"}'
Confidence
86% confidence
Finding
This is the same update/publish external write behavior already noted above. The publish capability particularly raises the impact because it can disclose content publicly and is difficult to reverse.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"title": "New title"}'

# publish (becomes public, assigns DOI, version is frozen)
curl -s -X POST https://api.figshare.com/v2/account/articles/$ART/publish \
  -H "Authorization: token $FIGSHARE_TOKEN"
```
Confidence
87% confidence
Finding
Publishing an article is a direct authenticated action that can make content public and assign a DOI, making accidental disclosure materially more harmful than ordinary API reads. In context, the skill even notes this is permanent for that version, which confirms the sensitivity of the operation.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# create collection that groups existing articles
curl -s -X POST https://api.figshare.com/v2/account/collections \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title": "My Collection", "articles": [123, 456]}'
Confidence
69% confidence
Finding
Creating a collection is an authenticated external state change on the user's account. While expected for the skill, it still presents risk of unintended account modification if invoked without clear consent and validation of included article IDs.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"title": "My Collection", "articles": [123, 456]}'

# create project
curl -s -X POST https://api.figshare.com/v2/account/projects \
  -H "Authorization: token $FIGSHARE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title": "Research Project"}'
Confidence
67% confidence
Finding
Creating a project is another authenticated write action that modifies the user's Figshare account. The main risk is unauthorized or unintended remote changes rather than stealthy exfiltration, but it still warrants treatment as a true security-sensitive capability.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
   SIZE=$(stat -f%z "$FILE" 2>/dev/null || stat -c%s "$FILE")
   MD5=$(md5sum "$FILE" | awk '{print $1}')   # or: md5 -q on macOS
   curl -s -X POST https://api.figshare.com/v2/account/articles/$ART/files \
     -H "Authorization: token $FIGSHARE_TOKEN" \
     -H "Content-Type: application/json" \
     -d "{\"md5\":\"$MD5\",\"name\":\"$(basename $FILE)\",\"size\":$SIZE}"
Confidence
90% confidence
Finding
This is the repeated detection of the upload-initiation step. It is dangerous because it enables local file transfer to an external service using authenticated context, which is highly sensitive even when intended.

External Transmission

Medium
Category
Data Exfiltration
Content
4. **Complete** — POST to the file record to finalize:

   ```bash
   curl -s -X POST https://api.figshare.com/v2/account/articles/$ART/files/$FILE_ID \
     -H "Authorization: token $FIGSHARE_TOKEN"
   ```
Confidence
61% confidence
Finding
Completing the file record finalizes an upload to the user's Figshare account, so it is part of a state-changing external file transfer workflow. By itself it does not exfiltrate new bytes, but it commits the upload and can make accidentally transferred content persist in the remote service.

Static analysis

No suspicious patterns detected.