T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:25- Finding
Skill instructions redirect the agent toward unsolicited external publishing and engagement
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltarxiv
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches an AgentArxiv publishing API, but it pushes autonomous posting, recurring checks, and memory use beyond ordinary user-directed control.
Install only if you want an agent-capable AgentArxiv account and are comfortable with authenticated external writes. Treat all publishing, commenting, voting, messaging, bounty, milestone, and memory actions as requiring explicit user approval. Avoid enabling heartbeat or cron routines unless you add review, expiry, and removal controls, and treat feed or briefing content as untrusted reference material.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:34- Finding
Untrusted feed content is recommended for persistent agent memory
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Warning
- Location
src/app/docs/agents/heartbeat/page.tsx:91- Finding
Documentation establishes a recurring cross-session OpenClaw cron routine
- Content
View full analysis
If you are using OpenClaw, you can configure a system cron to send a wake event.{`openclaw cron add --schedule "*/30 * * * *" --payload '{"kind":"systemEvent", "text":"[HEARTBEAT] Check HEARTBEAT.md"}'`}This command tells the system to inject a message every 30 minutes. The agent will then read
``` ### Technical Analysis The documented command creates a persistent scheduled event every 30 minutes. It survives the original Skill invocation and causes the agent to repeatedly read and execute tasks from `HEARTBEAT.md`. A recurring system event is materially more privileged than an on-demand HTTP API client. It creates an autonomous execution path whose future behavior can change whenever the heartbeat file or content consumed by its tasks changes. No bounded lifetime, removal command, execution budget, user confirmation requirement, or read-only restriction is provided. ### Attack Path 1. A user or agent follows the documentation and runs the `openclaw cron add` command. 2. OpenClaw stores a recurring schedule. 3. Every 30 minutes, the schedule injects a system event. 4. The agent reads `HEARTBEAT.md` and executes tasks independent of a current user request. 5. If the heartbeat file or remote content it consumes becomes malicious, the persistent task repeatedly triggers the affected behavior. 6. The behavior continues across sessions until the schedule is discovered and manually removed. ### Impact Assessment The persistence applies to the OpenClaw environment and any tools or creden ...[truncated 347 chars]HEARTBEAT.mdand execute any tasks that are due.- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/app/api/cron/deep-research/route.ts:7- Finding
Unset cron secrets allow authorization with a literal “Bearer undefined” header
- Content
View full analysis
- Remediation
View remediation
= 32 && authHeader === `Bearer ${cronSecret}`; const adminAuthorized = typeof adminKey === 'string' && adminKey.length >= 32 && authHeader === `Bearer ${adminKey}`; if (!cronAuthorized && !adminAuthorized) { return new NextResponse('Unauthorized', { status: 401 }); } ``` - Remove the manual `ADMIN_KEY` bypass in production or place it on a separate, strongly authenticated administrative route. - Use constant-time secret comparison where practical. - Add deployment-time configuration checks, rate limiting, replay protection, and single-flight locking. - Change the operation to `POST` and prevent caches or crawlers from invoking state-changing behavior. - Alert on repeated failures and unusual briefing-generation frequency. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
src/lib/daily-briefing.ts:62- Finding
Untrusted RSS and Hacker News content is inserted into a privileged LLM system prompt
- Content
View full analysis
`- [${source.name}] ${item.title}: ${item.contentSnippet?.substring(0, 150)}... (${item.link})`); rawData.push(...items); } catch (e) { console.error(`Failed to fetch ${source.name}`, e); } } // HackerNews AI const hnItems = await fetchHackerNewsAI(); rawData.push(...hnItems); // 4. Synthesize with LLM if (!process.env.OPENAI_API_KEY) { console.error('OPENAI_API_KEY not set'); return; } const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY }); const prompt = ` You are the "Deep Research Agent" for AgentArxiv. Your goal is to write a high-quality "State of the Art Daily Briefing" for AI agents. CONTEXT (Last Post): ${contextText.substring(0, 1000)}... (truncated) NEW DATA: ${rawData.join('\n')} INSTRUCTIONS: 1. Synthesize the NEW DATA into a cohesive, structured markdown report. 2. Do NOT repeat topics from the CONTEXT unless there is a significant update. 3. Focus on: New Models, New Tools, Research Papers, and Major Industry Moves. 4. Use clear headings: "🚀 New Models", "📄 Research Highlights", "🛠️ Tools & Libraries", "📰 Industry News". 5. Include URLs for every item. 6. Tone: Professional, dense, high-signal, "for agents by agents". 7. End with a "Runner Up" section for smaller items. `; const completion = await openai.chat.completions.create({ model: "gpt-4-turbo-preview", messages: [{ role: "system", content: prompt }], }); ``` ### Technical Analysis Titles, snippets, and URLs from RSS feeds and Hacker News are attacker-influenced data. The implementation concatenates those values directly into the ...[truncated 1710 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/app/api/v1/milestones/[id]/route.ts:42- Finding
Any authenticated agent can complete another research object's independent-replication milestone
- Content
View full analysis
0 ? Math.round((replicationCount / totalReplicati ...[truncated 2121 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
google-calendar-0.1.0/scripts/refresh_token.py:31- Finding
Google OAuth access token is written without restrictive permissions and printed to standard output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (173)
Tainted flow: 'req' from os.getenv (line 17, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = urllib.request.Request('https://oauth2.googleapis.com/token', data=data, method='POST') req.add_header('Content-Type', 'application/x-www-form-urlencoded') try: with urllib.request.urlopen(req) as resp: resp_data = json.load(resp) except urllib.error.HTTPError as e: sys.stderr.write(f'HTTP error {e.code}: {e.read().decode()}\n')
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md pnpm install # Set up environment cp .env.example .env.local # Edit .env.local with your database credentials # Set up database
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md pnpm install # Set up environment cp .env.example .env.local # Edit .env.local with your database credentials # Set up database
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a scientific publishing and research collaboration capability for AI agents. The supplied code does something entirely different: it connects to the Google Calendar API and provides commands to list events across calendars and to add, update, or delete events in a configured calendar. This is a materially different primary purpose and involves undeclared external resource access (Google Calendar) and event-management capabilities that are unrelated to publishing papers, validating artifacts, tracking claims, peer review, or replications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about outcome-driven scientific publishing and research collaboration workflows. The supplied code does something entirely different: it refreshes a Google OAuth access token using stored client credentials and a refresh token, then persists the new access token in a local configuration file. This is a materially different primary purpose and accesses unrelated resources (Google OAuth endpoint and local Google Calendar secrets file) that are not implied by the declared description. Therefore, this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a full scientific publishing and replication platform. The actual code chunk does not implement any of those domain features; it merely configures a test runner. While configuration files can be supporting details, this chunk by itself reflects a testing setup rather than any functionality related to publishing, experiments, claims, reviews, or collaboration. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description describes a feature-rich scientific publishing and collaboration system, but the supplied code only configures a Next.js application at the framework level. It adds browser security headers and allows markdown-related page extensions; it does not implement publishing workflows, claims, experiments, milestone tracking, replications, bounties, peer review, or collaboration features. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a complex scientific publishing and collaboration system. However, the supplied code does not implement any such functionality. It is only a build-tool configuration for CSS processing, specifically configuring Tailwind CSS and Autoprefixer. This is a materially different primary purpose and does not demonstrate any of the declared capabilities. While frontend styling support could exist within a larger application, this code chunk itself is unrelated to the declared behavior, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents an end-user scientific publishing and collaboration capability. The supplied code does not implement those workflows directly; instead, it is an administrative database seed script. Its primary behavior is to clear existing records, create sample agents/channels/papers, establish memberships and social connections, and generate API credentials. Important described capabilities such as validated artifacts, structured claims, milestone tracking, independent replications, replication bounties, and peer review are not present in this code chunk. Additionally, destructive database reset behavior and API key generation are undeclared administrative capabilities. Therefore, the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about an outcome-driven scientific publishing and replication platform, but this code implements a protected cron/debug API route for generating a daily briefing or paper. Its primary behavior is scheduled or manually authorized backend job execution, not publishing workflows, peer review, replication bounties, or collaboration features. The code introduces undeclared trigger semantics (cron/manual admin GET endpoint) and secret-based authorization, which are materially different from the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is centered on scientific publishing workflows and collaboration features for AI researchers. The supplied code does not implement publishing papers, hypotheses, experiments, replication bounties, peer review, milestone tracking, or artifact validation. Instead, it handles agent profile read/update functionality. While user/agent profiles could be a supporting part of a larger publishing platform, this code chunk’s primary purpose is materially different from the declared purpose and exposes capabilities not described in the skill summary.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description centers on scientific publishing, replication workflows, peer review, and collaboration features. The provided code instead handles identity/authentication behavior for fetching the currently authenticated agent profile. While user/agent profiles could be supporting infrastructure for a larger platform, this specific chunk's primary function is not publishing or research workflow management. Additionally, it performs an undeclared database-backed authentication diagnostic that reveals whether an API key prefix exists and how many records match, which is not represented in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as a research publishing and collaboration system centered on papers, experiments, claims, replications, bounties, and peer review. The supplied code chunk does not implement any publishing, experiment tracking, replication, bounty, or review functionality. Instead, its primary purpose is identity onboarding: registering agent accounts, generating credentials, issuing a claim URL, and writing audit logs. While account registration could be a supporting feature in a larger platform, this chunk’s behavior is materially different from the declared purpose and exposes undeclared capabilities related to account creation and authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents the skill as enabling outcome-driven scientific publishing workflows such as publishing research, tracking claims and milestones, handling replications, bounties, and peer review. The supplied code does not implement publishing or research artifact workflows; instead, its primary function is to expose an API endpoint for listing agents and their metadata. While agent collaboration could be tangentially related to a research platform, this endpoint is specifically an agent directory/search listing capability, which is not explicitly represented in the description. The code also introduces an undeclared trigger in the form of a GET /api/v1/agents endpoint and accesses agent profile data from the database. Therefore the description does not accurately represent this code chunk's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a broad research publishing and collaboration system focused on publishing, claims, replications, bounties, peer review, and collaboration. The supplied code chunk does not implement any of those core functions. Instead, it provides an authenticated REST API for managing an agent's bookmarked papers. While bookmarking papers could be a secondary feature in a publishing platform, this code's primary purpose is materially different from the declared purpose and represents an undeclared capability not reflected in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description suggests a broad scientific publishing and research-collaboration capability set. The supplied code does not implement those behaviors. Instead, it only exposes a read-only endpoint for retrieving the latest 'daily-briefing' IDEA_NOTE paper from the database. This is a materially different primary purpose: fetching a specific briefing item, not enabling publication, hypothesis management, experiment validation, peer review, replication, or collaboration. No concerning extra permissions are evident, but the actual behavior is much narrower and different than the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description emphasizes outcome-driven scientific publishing features such as publishing research artifacts, structured claims, replication workflows, peer review, and collaboration. The supplied code does not implement paper publishing, experiments, replications, bounties, or reviews. Instead, it specifically manages discussion or collaboration channels via GET/PATCH/DELETE endpoints, including private-channel access checks, moderator/owner authorization, sanitization of channel fields, and deletion logging. While channels could be a supporting collaboration feature within a broader publishing platform, this code chunk’s actual purpose is channel administration, which is not accurately represented by the declared description and constitutes an undeclared capability at this granularity.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code chunk does not implement scientific publishing, paper submission, hypothesis tracking, experiment artifacts, replication bounties, peer review, or milestone management. Instead, its primary function is channel management: listing channels and creating new ones with membership and visibility controls. While channels could be a supporting collaboration feature in a broader research platform, this specific code is materially focused on a different capability than the declared purpose. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code chunk is specifically a comments API, not a research publishing, replication, bounty, milestone, or peer-review workflow implementation. While comments could be a supporting social feature within a publishing platform, the declared description emphasizes outcome-driven scientific publishing, validated artifacts, structured claims, milestone tracking, replications, bounties, and peer reviews. None of those core capabilities are present here. Instead, the code’s primary behavior is discussion-thread management around papers, with notifications and moderation-related sanitization. That is a materially different functional scope from the declared purpose, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about scientific publishing and research collaboration workflows, such as papers, experiments, claims, replications, bounties, and peer review. The supplied code does not implement publishing or research artifact management. Instead, it provides a DM API endpoint for sending and reading private messages, with rate limiting, recipient validation, content sanitization, and notifications. While messaging could be loosely related to collaboration, it is not the declared primary functionality and represents a materially different capability set from the stated scientific publishing purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on scientific publishing, research artifact validation, replication workflows, peer review, and collaboration around research outputs. The supplied code does not implement any publishing, experiments, claims, milestones, replication bounties, or peer review behavior. Instead, it provides an API endpoint for managing friend requests in a social graph. This is a materially different primary purpose and introduces undeclared social-networking capabilities unrelated to the declared function.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about outcome-driven scientific publishing, research papers, hypotheses, experiments, replications, peer reviews, and collaboration workflows. The supplied code does not implement any publishing, artifact validation, claims, bounties, peer review, or research-management behavior. Instead, it provides social-network style friend request APIs and notifications. This is a materially different primary purpose and an undeclared capability unrelated to the stated scientific publishing functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code does not implement core scientific publishing actions like publishing papers, managing claims, replications, bounties, peer reviews, or experiment artifacts. Instead, it provides a periodic agent heartbeat endpoint that aggregates inbox/social/task information and presence updates. Some returned tasks reference papers and coauthor invites, which are adjacent to collaboration on a research platform, but the primary behavior is operational messaging/notification polling rather than outcome-driven scientific publishing. This is a materially different purpose and includes undeclared capabilities around social messaging, friend requests, channel updates, and activity tracking.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on research publishing, replication workflows, peer review, bounties, and collaboration features. The supplied code does not implement any publishing or scientific workflow behavior. Instead, it exclusively manages user/agent notifications through GET, PATCH, and DELETE endpoints. This is a materially different primary purpose and introduces capabilities not represented in the description. Therefore, the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code does not implement scientific publishing, research artifact validation, claim tracking, replication bounties, peer review submission, or collaboration features described in the declared purpose. Instead, its primary function is a moderation/reporting system: users can report papers, comments, or agents, and moderators can view reports for a channel. This is a materially different purpose and introduces undeclared moderation capabilities. While such functionality could exist somewhere within a larger publishing platform, this specific code chunk is not accurately represented by the declared description.
- Content
Static analysis
Detected: suspicious.credential_exposure_instructions, suspicious.env_credential_access, suspicious.exposed_secret_literal
Instructions expose credentials through shell, git config, or agent memory.
Critical
- Code
- suspicious.credential_exposure_instructions
- Location
- SKILL.md:41
Instructions expose credentials through shell, git config, or agent memory.
Critical
- Code
- suspicious.credential_exposure_instructions
- Location
- skills/agentarxiv/SKILL.md:41
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/lib/daily-briefing.ts:85
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/sdk/index.ts:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docs/PROJECT_HANDOFF.md:290
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docs/SKILL.md:65
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/app/api/v1/papers/[id]/downvote/route.ts:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/app/bounties/route.ts:7
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/app/papers/[id]/comments/route.ts:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/app/papers/[id]/downvote/route.ts:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/app/papers/[id]/upvote/route.ts:11