T09 · Insecure Skill Coding Practices
Error
- Location
config.yaml:27- Finding
API Credentials and Research Content Sent to a Non-Official Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Eve Research Supervisor Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent research-assistant purpose, but it needs Review because it can send credentials and research content to a non-official LLM endpoint, persist sensitive research data indefinitely, and run unsafe SSH automation.
Install only after reviewing the code and configuring a trusted LLM endpoint yourself. Do not reuse an official OpenAI API key with the default api.openai-hk.com endpoint unless you explicitly trust that operator. Avoid using the SSH monitoring features on sensitive servers until host-key checking, command validation, and path handling are fixed. Treat the memory files as long-lived local records of your research, profile, server details, and notes, and clear them manually if needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:40- Finding
Mutable Personal Repository Is Cloned and Immediately Executed
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:10- Finding
Session-Wide Agent Identity and Behavior Hijacking
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server_monitor.py:120- Finding
Remote Command Injection in SSH and Experiment Monitoring Operations
- Content
View full analysis
/dev/null | head -1") if out: log_file = out.strip() break if not log_file: out, _ = ssh_cmd( cfg, f"scontrol show job {job_id} 2>/dev/null | grep StdOut | awk -F= '{{print $2}}'" ) if out: log_file = out.strip() while True: out, err = ssh_cmd( cfg, f"tail -n +{seen_lines+1} {log_file} 2>/dev/null" ) status_out, _ = ssh_cmd( cfg, f"squeue -j {job_id} --noheader 2>/dev/null" ) ``` The `run` action is similarly vulnerable: ```python elif sys.argv[1] == "run" and len(sys.argv) >= 3: cfg = load_config() out, err = ssh_cmd( cfg, f"cd {cfg.get('workdir','~')} && sbatch {sys.argv[2]}" ) print(out or err) ``` The alert subsystem also interpolates unvalidated values: ```python status = ssh_run( f"squeue -j {job_id} --noheader 2>/dev/null" ) log_content = ssh_run( f"find {workdir} -name '*{job_id}*' -newer /tmp " f"-exec tail -100 {{}} \\; 2>/dev/null | tail -200" ) ``` ### Technical Analysis The code constructs remote-shell command strings using CLI-controlled `job_id` and script names, configuration-controlled `workdir`, and remotely discovered log paths. These values are not strictly validated or shell-escaped. Although local `subprocess.run` uses an argument list, t ...[truncated 1386 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/server_monitor.py:42- Finding
SSH Host Authentication Is Explicitly Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/session_memory.py:17- Finding
Project Identifier Traversal Allows Writes Outside the Memory Directory
- Content
View full analysis
= 5: add_entry(sys.argv[2], sys.argv[3], sys.argv[4]) elif action == "sync" and len(sys.argv) >= 3: papers_dir = sys.argv[3] if len(sys.argv) > 3 else "papers_pdf" sync_from_pipeline(sys.argv[2], papers_dir) ``` ### Technical Analysis The project identifier is concatenated with `.json` and joined to the memory directory without slug validation, canonicalization, or a containment check. A value containing path separators and parent-directory components can resolve outside `BASE`. The target content must be valid JSON generated by the script, and the `.json` suffix limits some targets, but an attacker can still create or overwrite JSON files writable by the current user. ### Attack Path 1. An attacker or untrusted automation supplies a crafted project identifier containing parent-directory components. 2. `get_project_file` joins that identifier with `BASE`. 3. The operating system resolves the traversal components. 4. `save_project` opens the resolved path in write mode. 5. The target JSON file outside the intended memory directory is created or overwritten. ### Impact Assessment The vulnerabil ...[truncated 312 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:23- Finding
Automatic Installation of Unpinned Python Dependencies
- Content
View full analysis
/dev/null || pip3 install requests -q python3 -c "import pypdf" 2>/dev/null || pip3 install pypdf -q python3 -c "import matplotlib" 2>/dev/null || pip3 install matplotlib -q python3 -c "import numpy" 2>/dev/null || pip3 install numpy -q echo "✅ Python dependencies OK" ``` The package metadata automatically invokes the installer: ```json { "files": [ "SKILL.md", "README.md", "config.yaml", "install.sh", "scripts/", "templates/", "docs/", "assets/" ], "postinstall": "bash install.sh", "engines": { "python": ">=3.9" }, "dependencies": { "python": ["requests", "pypdf", "matplotlib", "numpy"] } } ``` The Skill instructions also recommend additional unpinned packages: ```bash pip install torch torchvision diffusers transformers pip install accelerate datasets pypdf requests ``` ### Technical Analysis The installer retrieves packages by mutable name without exact versions, hashes, a lockfile, or a guaranteed package index. Installation may occur automatically through the package lifecycle hook. Python package installation can execute package build and installation logic. The listed package names are common legitimate packages; no typosquatted dependency was identified in the audited snapshot. The risk arises from mutable, unverified dependency resolution and automatic execution rather than confirmed malicious content in those packages. ### Attack Path 1. A user installs the package and triggers the `postinstall` hook. 2. `install.sh` checks for imports in the active Python environment. 3. Any missing dependency is fetched from the config ...[truncated 608 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (66)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The global critical rule says to confirm before running any pipeline step in Semi-Manual mode, but the documented semi-auto flow also instructs the agent to run multiple technical steps silently in AUTO ZONE. That conflict can cause an agent to choose the less restrictive interpretation and execute network, file, or processing actions without the level of user approval the policy appears to require.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The docstring claims the research mode writes from real experimental data, but the implementation generates core scientific sections from an LLM using sparse notes and ideas and even inserts placeholder figures/tables when no data exists. In an academic-paper-writing context, this is dangerous because it can mislead users into producing fabricated or unsupported research artifacts that appear legitimate.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ("host", "Server hostname or IP (e.g. 10.26.xx.xx or login.hpc.edu):"), ("user", "Username:"), ("port", "SSH port (default 22):"), ("ssh_key", "SSH key path (e.g. ~/.ssh/id_rsa, or Enter for password):"), ("workdir", "Remote working directory (e.g. /home/user/research):"), ("scheduler","Job scheduler (slurm / pbs / none):"), ]
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The code records user-supplied values into the persistent
sessionslog by embedding up to 80 characters ofvaluein theactionfield. If users store secrets, API keys, personal data, or sensitive research content, those values will be duplicated into long-lived memory files and later displayed in summaries, increasing unintended disclosure risk. In this skill context, persistent cross-session research memory makes retention and resurfacing of sensitive content more dangerous than a transient log.- Content
python data[key] = [] data[key].append({"timestamp": timestamp, "content": value}) # Log session event data["sessions"].append({ "timestamp": timestamp, "action": f"Added {key}: {str(value)[:80]}"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README promotes server monitoring with SSH access and job inspection without warning that the skill may access remote systems, logs, GPU status, and experiment artifacts. In this context, users may unknowingly grant the agent visibility into sensitive infrastructure and research data, increasing the risk of credential misuse or unintended disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises persistent session memory across sessions and weeks but provides no warning about what research data is retained, how long it is stored, or how users can clear it. In a research assistant context, retained prompts, notes, unpublished ideas, and potentially sensitive project details can accumulate and later be exposed or misused if storage is insecure or shared.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
One-line install (copy + paste)
bash git clone https://github.com/amzayn/eve-research-supervisor-pro && cd eve-research-supervisor-pro && bash install.sh && mkdir -p ~/.openclaw/workspace/skills/eve-research-supervisor-pro && cp SKILL.md ~/.openclaw/workspace/skills/eve-research-supervisor-pro/SKILL.md && echo "✅ EVE installed!"Step by step
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
One-line install (copy + paste)
bash git clone https://github.com/amzayn/eve-research-supervisor-pro && cd eve-research-supervisor-pro && bash install.sh && mkdir -p ~/.openclaw/workspace/skills/eve-research-supervisor-pro && cp SKILL.md ~/.openclaw/workspace/skills/eve-research-supervisor-pro/SKILL.md && echo "✅ EVE installed!"Step by step
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
One-line install (copy + paste)
bash git clone https://github.com/amzayn/eve-research-supervisor-pro && cd eve-research-supervisor-pro && bash install.sh && mkdir -p ~/.openclaw/workspace/skills/eve-research-supervisor-pro && cp SKILL.md ~/.openclaw/workspace/skills/eve-research-supervisor-pro/SKILL.md && echo "✅ EVE installed!"Step by step
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that the tool uses a built-in API key automatically and separately documents use of a third-party API endpoint, but it does not warn that prompts, papers, notes, or research data may be transmitted externally. This creates a meaningful privacy and compliance risk, especially for unpublished or proprietary research content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The README references an external API base URL, indicating that data handled by the skill may be transmitted to a third-party service. In a research-assistant context, uploaded prompts and document-derived content may include sensitive or unpublished material, so undisclosed external transmission is a real security and privacy concern.
- Content
For non-PetClaw:
bash export OPENAI_API_KEY=your_key export OPENAI_BASE_URL=https://api.openai-hk.com/v1Optional (citation graph visualization):
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to read memory before every action and update it after every major step establishes broad persistent retention and reuse of user data across sessions. Without minimization or consent boundaries, this can accumulate sensitive research, personal, and system information beyond user expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill collects profile data such as major, interests, goals, venue, and compute details, then persists it across sessions without a clear privacy notice, retention policy, or consent step. Users are told the data will be remembered 'forever,' which increases the chance of overcollection and unexpected long-term storage of personal or sensitive academic information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Telling users their answers will be remembered forever signals indefinite retention without qualification, which is a privacy and data governance risk. It encourages storage of potentially identifying academic and system details without any retention limit or deletion mechanism.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The skill explicitly writes user profile data to a persistent JSON file in the workspace, creating cross-session retention of personal and research-related information. Without notice, retention limits, and deletion controls, this persistence can expose sensitive data to later sessions, other tools, or anyone with filesystem access.
- Content
python3 ~/.openclaw/workspace/research-supervisor-pro/scripts/session_memory.py save _profile compute ""
text Also write to:~/.openclaw/workspace/research-supervisor-pro/memory/user_profile.json
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Trigger: user says
"2"/"semi"/"semi-auto"/"guided"Philosophy: EVE runs everything automatically — but pauses at 3 key decisions where only YOU can decide. No approvals for technical steps. Fast like Auto, smart like Manual.
text AUTO ZONE → [search + download + parse + rank + graph] runs silently
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation says Semi-Auto 'pauses at 3 key decisions where only YOU can decide,' implying an approval gate at each decision point. But later steps explicitly say 'Then immediately continue' after Pause 1 and Pause 2, meaning the skill resumes execution automatically without a separate confirmation, which contradicts the stated interaction model.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The roadmap flow collects detailed environment and capability information including GPU, OS, installed tooling, dataset access, timeline, and coding level, then saves it to memory. That information can reveal system posture and operational constraints, making it sensitive if exposed or reused improperly.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ║ ideas for gap [N] For specific gap ║ ║ ║ ║ WRITING ║ ║ write survey Full survey paper ║ ║ write research paper With real data ║ ║ write [section] One section only ║ ║ generate figures From data file ║
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The server monitoring feature includes remote status checks, log watching, file pulling, and job submission over SSH/SLURM, but it does not require prominent confirmation or explain the risks of remote execution and data transfer. In practice, this could lead to unintended commands on a GPU server or silent retrieval of sensitive experiment outputs from remote systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs automatic use of built-in API credentials from a local settings file and fallback to environment credentials without a user-facing warning or consent for outbound requests. This creates a risk that the agent will access secrets and transmit user or research data to external services unexpectedly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
Using a nonstandard external API endpoint as the default causes model requests and associated context to be transmitted off-system to infrastructure not clearly identified as the official provider. In a skill that performs autonomous research with web access, memory, and execution tooling, those requests can include sensitive prompts, collected documents, and environment-derived metadata, increasing confidentiality and compliance risk.
- Content
yaml llm: default_model: gpt-4o base_url: "${OPENAI_BASE_URL:-https://api.openai-hk.com/v1}" api_key: "${OPENAI_API_KEY:-}" author: Zain Ul Abdeen
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest defines a default LLM base URL pointing to a third-party Hong Kong–specific endpoint rather than the standard vendor API, with no user-facing justification, consent flow, or trust documentation. Because this skill also enables memory and an exec-capable research workflow, prompts, retrieved content, and possibly sensitive workspace-derived data may be transmitted to that endpoint unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer writes into the user's home workspace and installs Python packages via pip3 without any prior consent prompt, dry-run mode, or clear warning that it will modify the environment. While this is common installer behavior and not inherently malicious, it can unexpectedly alter the user's Python environment, introduce dependency conflicts, or make rollback difficult.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh if ! command -v dot &>/dev/null; then echo "ℹ️ Optional: install Graphviz to visualize citation graphs:" echo " macOS: brew install graphviz" echo " Linux: sudo apt install graphviz" fi echo ""
Static analysis
No suspicious patterns detected.