ClawHub
Back to skill

Security audit

Paper Design

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Paper design-tool bridge, but it has review-worthy risks around unrestricted endpoint configuration and local file writes.

Install only if you trust this Paper workflow and understand that it can read and modify open design files. Avoid setting PAPER_MCP_URL unless it points to a trusted local Paper server, do not use --save with sensitive or existing paths, and prefer running on a single-user machine until temp-file handling is tightened.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
paper.sh:23
Finding

Unrestricted MCP Endpoint Allows Design Data Disclosure to Remote Servers

Content
View full analysis
/dev/null | grep -q "200\|400\|405"; then ``` ```bash response=$(curl -s -i -X POST "$PAPER_MCP_URL" \ -H "Content-Type: application/json" \ -H "Accept: $ACCEPT_HEADER" \ -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"openclaw-paper-skill","version":"1.0.0"}},"id":1}' 2>&1) ``` ```bash response=$(curl -s -X POST "$PAPER_MCP_URL" \ -H "Content-Type: application/json" \ -H "Accept: $ACCEPT_HEADER" \ -H "Mcp-Session-Id: $session_id" \ -d "$payload" 2>&1) ``` ### Technical Analysis The skill is documented as a bridge to Paper's local MCP server, but `PAPER_MCP_URL` is accepted directly from the process environment without validating its scheme, hostname, port, or path. Every initialization request and subsequent MCP tool request is sent to that endpoint. An attacker who can influence the environment of the skill process can replace the loopback URL with a remote server. The transmitted payload can include MCP tool names, node identifiers, HTML content, text content, design metadata, or other arguments supplied during design operations. The MCP session identifier received from the configured server is also sent in later requests. Because the remote response is trusted as an MCP response, the issue additionally permits an attacker-controlled endpoint to supply arbitrary response content and image bytes to downstream response-processing functions. ### Attack Path 1 ...[truncated 1189 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
paper.sh:24
Finding

Predictable Shared Temporary Session File Enables Symlink Attacks and Session Exposure

Content
View full analysis
/dev/null || echo 0) )) if [ "$age" -lt 1800 ]; then cat "$PAPER_SESSION_FILE" return 0 fi fi ``` ```bash # Cache session echo "$session_id" > "$PAPER_SESSION_FILE" echo "$session_id" ``` ### Technical Analysis The MCP session identifier is stored at a fixed, predictable path under the shared `/tmp` directory. The script reads and truncates this path without verifying that it is a regular file owned by the current user and without rejecting symbolic links. The shell redirection in `echo "$session_id" > "$PAPER_SESSION_FILE"` follows symbolic links. A local attacker able to create the predictable path before the victim runs the skill can point it to another file writable by the victim. The next session initialization then truncates and overwrites that target with the MCP session identifier. The code also does not set a restrictive `umask` or explicitly assign permissions such as mode `0600`. Depending on the user's active `umask`, the session identifier may be readable by other local users. A pre-created regular file can also contain an attacker-chosen session identifier that the script will consume when its modification time is less than 30 minutes old. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/paper-mcp-session`. 2. The attacker performs one of the following: - Creates a symbolic link at that path to a file writable by the victim. - Creates a regular file containing an attacker-selected session identifier and gives it a recent modification time. - Monitors or reads an insufficiently protected cache file. 3. The victim invokes `paper.sh`. 4. If a n ...[truncated 950 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
paper.sh:149
Finding

Unrestricted Screenshot Save Path Permits Overwriting Arbitrary User-Writable Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to invoke a local shell script (paper.sh) via exec, but the manifest does not declare any permissions or allowed-tools scope limiting shell use. That creates an over-broad execution surface: a user-invocable skill can trigger local command execution without explicit tool scoping, increasing the risk of unintended or abused shell access if the wrapper script or its arguments are ever influenced unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · paper.sh (reported line 34)May include surrounding context.

sh
# Check if Paper is reachable
check_paper() {
  if ! curl -s --max-time 3 -o /dev/null -w "%{http_code}" "$PAPER_MCP_URL" -X POST \
    -H "Content-Type: application/json" \
    -H "Accept: $ACCEPT_HEADER" \
    -d '{"jsonrpc":"2.0","method":"ping","id":0}' 2>/dev/null | grep -q "200\|400\|405"; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · paper.sh (reported line 70)May include surrounding context.

sh
# Initialize new session
  local response
  response=$(curl -s -i -X POST "$PAPER_MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: $ACCEPT_HEADER" \
    -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"openclaw-paper-skill","version":"1.0.0"}},"id":1}' 2>&1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · paper.sh (reported line 83)May include surrounding context.

sh
fi

  # Send initialized notification
  curl -s -X POST "$PAPER_MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: $ACCEPT_HEADER" \
    -H "Mcp-Session-Id: $session_id" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · paper.sh (reported line 116)May include surrounding context.

sh
fi

  # Send initialized notification
  curl -s -X POST "$PAPER_MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: $ACCEPT_HEADER" \
    -H "Mcp-Session-Id: $session_id" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · paper.sh (reported line 126)May include surrounding context.

sh
fi

  # Send initialized notification
  curl -s -X POST "$PAPER_MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: $ACCEPT_HEADER" \
    -H "Mcp-Session-Id: $session_id" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script automatically decodes screenshot image data returned by the local Paper MCP server and writes it to disk under /tmp or an arbitrary caller-supplied path, without any confirmation, warning, or restriction. In an agent context, screenshots can contain sensitive design content or user data, and silent persistence increases the chance of unintended local data exposure to other processes or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script stores the MCP session identifier in a persistent file under /tmp without setting restrictive permissions or warning the user. Although this is a local integration, /tmp is a shared location on many systems, so another local process or user could potentially read or tamper with the cached session state.

Content

No source excerpt is available for this finding.