Research Review Skill Factory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.1

Overview

This is a coherent research-review skill factory, but it should be reviewed before installation because it can generate future agent skills from unvalidated local text and profile data.

Install only if you are comfortable reviewing generated child skills before using or sharing them. Use trusted profile JSON and reference Markdown files, keep generated outputs in a sandboxed workspace, and inspect the generated SKILL.md, agents/openai.yaml, and references before installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_research_area_review_skill.py:82

Finding

Untrusted Profile Data Is Embedded into Generated Skill Instructions and YAML Configuration

Content

View full analysis

str: area_name = spec.get("area_name") or skill_name scope = spec.get("one_sentence_scope") or "not reported" description = ( f"Review papers in the research area '{area_name}' using a custom area profile, " "OpenReview-derived reviewer concern patterns, subtle logic flaw checks, " "and rebuttal/revision planning. Use for papers in this field/problem family." ) return f"""--- name: {skill_name} description: {description} license: MIT-0 --- # {area_name} Reviewer OpenReview Use this area-specific skill to review papers in this research field or problem family. Scope: {scope} ``` ```python write( skill_dir / "agents" / "openai.yaml", "interface:\n" f" display_name: \"{spec.get('area_name', skill_name)} Reviewer\"\n" " short_description: \"Custom OpenReview-grounded area review skill.\"\n" f" default_prompt: \"Use ${skill_name} to review this paper in the target research area.\"\n", ) ``` ### Technical Analysis The generator reads an arbitrary JSON profile and interpolates fields such as `area_name` and `one_sentence_scope` directly into generated Markdown, YAML front matter, and `agents/openai.yaml`. These values are not restricted to single-line scalar data and are not escaped using a YAML-aware serializer. An attacker-controlled value can therefore contain: - newline characters; - additional YAML keys; - quotation marks that terminate the intended YAML scalar; - Markdown headings or directives; - instructions intended to alter the behavior of an Agent loading the generated Skill. For example, a crafted `area_name` could close the `display_name` value and introduce ...[truncated 2053 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/init_research_area_review_skill.py:267

Finding

Arbitrary Markdown Files Can Be Imported as Mandatory Child-Skill Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code aligns with the evidence-gathering portion of the description: it fetches public ICLR/OpenReview data, filters by field/topic, extracts reviewer concerns, meta-reviews, decisions, comments, and accepted-paper author responses, and summarizes them. However, the declared purpose's primary promise is broader and output-oriented: building custom peer-review skills and generating a ClawHub-ready reviewer skill tailored to a field/problem. This script does not create any such skill, prompt, template, or packaged artifact; it only produces field_evidence.json and field_evidence.md. There are no unrelated or suspicious undeclared capabilities beyond network access to OpenReview and local file output, which are consistent with the retrieval/synthesis support role. Still, because the implemented primary behavior stops at evidence collection/export rather than reviewer-skill generation, the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

- The generated child skill must include `SKILL.md`, `agents/openai.yaml`, `references/research_area_profile.md`, `references/openreview_review_response_bank.md

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_research_area_review_skill.py (reported line 237)May include surrounding context.

python

skill_dir = resolve_child_dir(Path(args.output_dir), skill_name)
    if skill_dir.exists():
        raise FileExistsError(f"Refusing to overwrite existing skill directory: {skill_dir}")

    write(skill_dir / "SKILL.md", build_skill_md(skill_name, spec))
    write(skill_dir / "references" / "research_area_profile.md", build_profile_md(spec))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs use of Python scripts that fetch network data, read references, write evidence/output directories, and generate child skill artifacts, but it declares no tool/permission scope. In an agent environment, missing least-privilege boundaries can let the skill invoke broader filesystem and network capabilities than reviewers expect, increasing the chance of unintended data access, uncontrolled writes, or misuse if the skill or its inputs are modified.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/init_research_area_review_skill.py (reported line 26)May include surrounding context.

python

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown content presents core user-facing sections in both Chinese and English, but it does not state whether users can choose their preferred language or whether the mixed-language presentation is intentional. Under the language/locale policy rule, user-facing language constraints or defaults should be explicit or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file begins with a full Chinese introduction and usage section before the English overview, but it does not explicitly state that users may choose their preferred language. Under the policy rule, forcing or assuming a specific language without opt-in can be a natural-language policy concern even when another language appears later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code creates an output directory and writes both JSON and Markdown files containing paper metadata and public review/comment text. Although the script's docstring explains that it fetches OpenReview data, there is no user-facing warning at write time or comment/disclosure near the file-write logic that the fetched content will be stored locally in the specified output directory.

Content

No source excerpt is available for this finding.