Security audit

Literature Daily Report

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it also automatically publishes or syncs generated reports to shared services without enough clear user control.

Review before installing. Only run it if you are comfortable with generated literature reports being saved locally, copied into ClawLib, sent to Matrix, and added to a Zotero group library. Use a limited-scope Zotero API key, verify the group ID, inspect the referenced Zotero helper script, and disable Matrix/Zotero automation if you want local-only report generation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable behavior including environment-variable access, filesystem reads/writes, network access, and shell execution, but does not declare permissions or boundaries. That creates a transparency and consent problem: users and the hosting platform cannot accurately assess or constrain what the skill may do before activation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose focuses on literature collection and report generation, but the document also describes extra side effects: synchronizing files to another local directory and ingesting records into a Zotero group library; the finding also notes proactive message sending via Matrix. Undisclosed or under-disclosed side effects are dangerous because they can exfiltrate data, modify shared resources, or trigger external communications beyond what a user reasonably expects from a report-generation skill.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill not only generates a local report but also transmits the full report to Matrix and writes entries to Zotero, which are external publication actions beyond a narrow 'report generation' expectation. In an agent setting, this expands the data exposure surface and can leak collected content, metadata, or future user-supplied notes to third-party systems without clear consent at execution time.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code is hard-wired to invoke another workspace script for Zotero operations, creating a hidden trust boundary and extra execution capability not obvious from the skill's stated purpose. If that helper script is modified, replaced, or compromised, running this skill can execute unintended code with the current user's environment and filesystem access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill states that generated reports are automatically synced into a ClawLib directory, which is a filesystem write side effect not paired with a warning, opt-in, or path-scope explanation. Silent automatic copying can overwrite files, leak generated content into shared workspaces, and surprise users who intended only local report creation.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The Markdown documents automatic ingestion into a Zotero group library using API credentials, but it does not warn users that collected bibliographic data and tagging choices will be pushed to a shared remote library. This creates privacy, data-governance, and integrity risks because generated selections may be disclosed to collaborators or external services without explicit consent or review.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes and overwrites dated and latest report files in the workspace without confirmation, which can destroy prior content or unexpectedly persist generated material. In an agent environment, silent file creation/modification is risky because users may not realize the skill changes state outside the immediate response.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script silently copies generated reports into a second directory under ClawLib, expanding persistence and distribution of the content beyond the primary output location. This increases the risk of unintentional disclosure, duplicated stale data, and writes into another workspace area the user may not expect this skill to modify.

Static analysis

No suspicious patterns detected.