ClawHub
Back to skill

Security audit

Zhiyan Smart Research

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed literature searches and saves local research notes for follow-up, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable sending literature search terms to Crossref and PubMed and saving generated research reports locally under research/sessions. Avoid using confidential or unpublished research topics unless local session retention and third-party lookup are acceptable, and delete saved session files when they are no longer needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to perform network access, read and write local files, and access environment-provided configuration, but the skill metadata declares no explicit permissions. This creates a transparency and policy-enforcement gap: operators may approve or run the skill without realizing it can exfiltrate query data to external services or persist sensitive research/session content locally.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The README explicitly states that the skill automatically maintains persistent session memory and instructs the agent to read prior session files before continuing research, but this persistence is not disclosed in the skill manifest. Undocumented persistent memory can expose prior user queries, research topics, citations, or sensitive context across runs, creating privacy, data retention, and cross-session context leakage risks.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation states that research results are automatically saved to `research/sessions/`, but it does not clearly warn users that potentially sensitive prompts, summaries, and cited content will be persisted on disk. In a research assistant context, users may submit unpublished ideas, confidential topics, or personal data, so silent persistence creates a real privacy and data-retention risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill documents cross-session reuse of prior session content from `research/sessions/*.md` without a clear warning or consent mechanism. This can cause prior sensitive research topics or user-provided material to be silently reintroduced into later conversations, leading to privacy leakage, context contamination, or disclosure to other users sharing the same environment.

Missing User Warnings

Low
Confidence
80% confidence
Finding
User-supplied search queries are transmitted to Crossref and PubMed, which means potentially sensitive research topics may be disclosed to third-party services. In a literature-search skill this data flow is expected, but the lack of explicit disclosure or consent can still create a privacy issue, especially for confidential or proprietary research queries.

External Transmission

Medium
Category
Data Exfiltration
Content
from concurrent.futures import ThreadPoolExecutor, as_completed

TIMEOUT = 12
CROSSREF_BASE = "https://api.crossref.org/works"
PUBMED_SEARCH = "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi"
PUBMED_SUMMARY = "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esummary.fcgi"
Confidence
85% confidence
Finding
The skill is designed to call external APIs over the network, transmitting user search terms and a mailto identifier in the User-Agent to third-party endpoints. In this skill context, external transmission is core functionality, but it still carries privacy and metadata-leakage risk if users enter sensitive or non-public research topics.

Static analysis

No suspicious patterns detected.