ClawHub
Back to skill

Security audit

Journal Matchmaker

Security checks for vulnerabilities and agentic risk

Overview

This is a local journal-recommendation skill with some ordinary file and dependency hygiene issues, but no evidence of hidden access, exfiltration, persistence, or destructive behavior.

Install only in an environment where you are comfortable running local Python code. Prefer removing or pinning the dataclasses dependency before installation, and use the --file option only for abstract files you intentionally want analyzed, not arbitrary private or credential-containing files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unnecessary and Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Supply-chain exposure through an unnecessary, unpinned dependency
Risk Level: Medium

Vulnerable Code

text
dataclasses

The installation instruction is documented in SKILL.md:124-128:

bash
# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project declares the dataclasses package without a version constraint or integrity hash. dataclasses has been included in the Python standard library since Python 3.7, and the script imports it at scripts/main.py:17. For supported modern Python versions, installing a separate package from PyPI is unnecessary.

An unpinned requirement permits the package installer to resolve whatever version is available from the configured package index at installation time. This makes the installed artifact mutable after the Skill has been reviewed. If the package, its release process, or the configured package index is compromised, malicious package installation or import-time code could execute in the user's environment.

This finding does not establish that the current dataclasses package is malicious. The vulnerability is the avoidable and unconstrained supply-chain trust introduced by the project configuration.

Attack Path

  1. A user follows the documented prerequisite and runs pip install -r requirements.txt.
  2. pip resolves the unpinned dataclasses requirement using the user's configured package index and dependency resolution settings.
  3. An attacker who has compromised the selected package release, package distribution channel, or higher-priority configured index supplies a malicious artifact.
  4. Package-controlled installation logic executes during installation, or malicious code executes when scripts/main.py imports dataclasses.
  5. The payload runs with the operating-system privileges and environmental access of the user ...[truncated 658 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove dataclasses from requirements.txt and explicitly require Python 3.7 or later in the project documentation and packaging metadata.
  2. If support for Python versions older than 3.7 is genuinely required, use a conditional environment marker and a reviewed exact version, for example:
    text
    dataclasses==0.8; python_version < "3.7"
  3. Generate and enforce cryptographic hashes for all required third-party distributions, such as through a locked requirements file installed with pip --require-hashes.
  4. Install dependencies only from an approved package index and disable unintended fallback or extra indexes in controlled environments.
  5. Add automated dependency and provenance review to the release process.
  6. Update SKILL.md so its prerequisite instructions reflect the supported Python version and hardened installation procedure.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documentation indicates code capabilities involving file reads and writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent or reviewer cannot verify what filesystem access is intended, increasing the risk of overbroad file access, path traversal, or unintended reading/writing of workspace data when the script is executed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest and module description frame this skill as an analyzer/recommender for manuscript abstracts, but the implementation creates a default references/journals.json file when none exists. Persisting new data to disk is additional behavior beyond simple recommendation logic and is not described as part of the skill's user-facing purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

When --file is set, the skill reads any local path supplied in --abstract and processes its contents, even though the skill's purpose is only to recommend journals from abstract text. In an agent environment, this can be abused to exfiltrate sensitive local files by treating them as 'abstracts' and then echoing derived content or metadata in output.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses

Static analysis

No suspicious patterns detected.