T08 · Insecure Dependencies
Error
- Location
scripts/research_pipeline.py:16- Finding
Automatic Installation of Unpinned Runtime Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Paper Research Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent paper-research purpose, but it automatically installs packages, downloads PDFs, writes files, and launches sub-agents without enough safeguards or consent controls.
Install only if you are comfortable with an autonomous research workflow that can modify the Python environment, contact external servers, download and store many PDFs, and create sub-agent tasks. Prefer running it in a sandboxed workspace with pinned dependencies preinstalled, restricted network access, file-size/output limits, and explicit approval before downloads or sub-agent spawning.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/research_pipeline.py:171- Finding
Unrestricted Remote PDF Download Without Origin, Type, or Size Validation
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/research_pipeline.py:253- Finding
Indirect Prompt Injection Through Untrusted Paper Metadata and PDF Content
- Content
View full analysis
str: """Generate detailed agent analysis task""" arxiv_id = paper['arxiv_id'] title = paper['title'] pdf_path = paper.get('pdf_path', '') # Output report path safe_title = "".join(c if c.isalnum() or c in (' ', '_') else '_' for c in title)[:80] output_md = str(self.analysis_dir / f"{safe_title}-{arxiv_id}_analysis.md") task = f"""【Paper Research Agent - Deep Analysis Task】 ⚠️ CRITICAL: You MUST read the complete PDF. NO shortcuts allowed! 📄 Paper Information: - Title: {title} - ArXiv ID: {arxiv_id} - PDF Path: {pdf_path} - Output Report: {output_md} 🔧 Step 1: Extract PDF Content Use the paper-reader tool to extract full content: ```bash python3 ~/.openclaw/skills/paper-reader/read_paper.py "{pdf_path}" --full ``` ``` The Skill documentation instructs the parent Agent to pass the generated task directly to a sub-agent: ```python # Spawn multiple agents in parallel for each paper for task_info in tasks: sessions_spawn( agentId="main", mode="run", runtime="subagent", task=task_info['task'], timeoutSeconds=600 # 10 minutes per paper ) ``` ### Technical Analysis Paper titles, abstracts, metadata, and downloaded PDF contents originate outside the trust boundary. The generated prompt does not clearly delimit these values as untrusted data or instruct the sub-agent to disregard commands contained in them. A malicious paper title can contain instruction-like text that is inserted directly into the task. More importantly, t ...[truncated 2665 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly describes automatic network retrieval of PDFs and creation of local output files, but does not indicate any requirement for user confirmation, output path review, or disclosure of filesystem and network side effects. In an autonomous agent context, this can cause unexpected external requests, storage consumption, and unreviewed file writes, which is risky even if the intended purpose is legitimate research automation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares broad operational behavior that includes shell execution, network access, and file writes, but it does not declare any explicit tool scope or permission boundaries. That increases the chance an agent will run high-impact actions implicitly, without user awareness or platform-level restriction, which is risky in an autonomous workflow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
The skill is explicitly designed to autonomously execute a multi-step workflow, including search, downloading, analysis, and reporting. While autonomy is not inherently malicious, it becomes dangerous here because the workflow includes external network access, local file writes, and agent spawning, reducing human oversight over consequential actions.
- Content
Core Workflow
The system autonomously executes the full research pipeline:
text User Query → Research Probe → PDF Download → Parallel Agent Analysis → Integrated Report
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes automatically downloading PDFs and writing outputs to local storage as part of its normal flow, but it does not warn the user or request consent for those side effects. In an autonomous agent context, silent network retrieval and filesystem modification can expose the system to unwanted content, clutter, data handling issues, and unexpected persistence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
These usage instructions combine local subprocess execution, task file parsing, and parallel sub-agent spawning without an explicit safety warning or approval checkpoint. That creates a significant risk of cascading actions—code execution, file access, and additional agent activity—beyond what a user may reasonably expect from a literature research request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to launch a local Python subprocess to run an orchestration pipeline from the user's environment. Executing local code is a powerful capability that can do far more than paper research, and the skill provides no sandboxing, integrity verification, or user confirmation before running it.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains natural-language instructions written as the required reporting standard and states that the SubAgent must follow this document to generate reports. Because the standard is defined entirely in Chinese and does not provide any opt-in or alternative language path, it effectively forces a specific language/locale for outputs, which matches the policy-violation category for language choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Auto-installing Python packages is not necessary for a paper-research workflow at execution time and creates a direct capability to fetch and run third-party code. In an autonomous agent skill, this is more dangerous because it occurs without operator review and can change the runtime environment in ways that are hard to audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Installing packages automatically without warning or confirmation is unsafe because it modifies the host environment and executes externally sourced code without informed consent. In an agent skill, this undermines least surprise and can expose systems to supply-chain malware or break reproducibility.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 89% confidence
- Finding
The code performs dynamic imports from a list and then falls back to package installation if imports fail. In this skill context, the larger issue is that dependency resolution and code acquisition happen automatically at runtime, which increases supply-chain risk and executes unreviewed code paths without user approval.
- Content
python deps = ['arxiv', 'requests', 'pdfplumber'] for dep in deps: try: __import__(dep) except ImportError: subprocess.run([sys.executable, '-m', 'pip', 'install', dep, '-q'])
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 93% confidence
- Finding
The subprocess call invokes pip to install packages automatically during normal execution. Even though arguments are not shell-expanded, this still allows network retrieval and installation of code at runtime, which can execute package install hooks and introduce supply-chain compromise or unexpected environment modification.
- Content
python try: __import__(dep) except ImportError: subprocess.run([sys.executable, '-m', 'pip', 'install', dep, '-q']) ensure_deps()
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest claims orchestration of the full pipeline from search to PDF download to parallel analysis to comprehensive report generation. This file downloads papers, creates task prompts, and writes a metadata summary, but the final report generation is explicitly a placeholder and depends on external/manual completion rather than being performed here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The method docstring says 'Spawn parallel agents for analysis,' and the manifest promises an autonomous multi-agent pipeline with parallel agent analysis. In practice, the function merely generates task files, saves JSON metadata, and instructs the user to run another script or manually spawn sub-agents, which contradicts the documented behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The documented output structure hard-codes the final integrated report filename as
综合调研报告.md, which suggests a specific locale convention. The README does mention Chinese and English queries, but it does not state that output language or filenames are user-selectable or context-dependent.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script makes outbound HTTP requests to paper PDF URLs and transmits request metadata to external services, but it does not clearly warn the user that executing the pipeline will contact remote servers. The progress prints show that downloading occurs, but they do not serve as advance disclosure of network activity before the operation begins.
- Content
Static analysis
No suspicious patterns detected.