ClawHub
Back to skill

Security audit

journal-monitor-xch

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a coherent PubMed journal-monitoring helper, with review notes around automatic report files and an unpinned Python dependency.

Before installing, expect the skill to install Biopython, contact PubMed/NCBI for journal and article lookups, translate article titles into Chinese, and create a Desktop report when many articles are found. Consider pinning Biopython and asking for confirmation before file creation if you need tighter control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Unpinned third-party dependency / supply-chain risk
Risk Level: Medium

Complete Code Snippet:

yaml
metadata: {
  "openclaw": {
    "emoji": "🧬",
    "requires": { "bins": ["python3"], "install": ["uv pip install biopython"] }
  }
}

Technical Analysis

The skill installs biopython without specifying an audited version, lockfile, package hash, or explicitly trusted package index. Consequently, installation may resolve to a package release that differs from the one reviewed.

Python packages can execute installation-time or runtime code. In this project, monitor.py imports Bio.Entrez, so installed package code is loaded into the Python process. If the upstream package, distribution infrastructure, configured package index, or dependency chain is compromised, an attacker-controlled release could execute with the permissions of the user running the skill.

This finding concerns mutable dependency resolution. The audit found no evidence that the current biopython package is malicious.

Attack Path

  1. An attacker compromises the package publication account, package index, distribution channel, or a transitive dependency used during resolution.
  2. The attacker publishes or serves a malicious package release that satisfies the unrestricted biopython requirement.
  3. Skill setup runs uv pip install biopython.
  4. The installer resolves and installs the attacker-controlled or compromised release.
  5. Malicious code executes during installation or when monitor.py imports Bio.Entrez.
  6. The payload operates with the privileges and accessible resources of the account running the skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that account's privileges and environment, the payload could read or modify accessibl ...[truncated 382 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin biopython to a specifically reviewed version rather than resolving the latest available release:
    yaml
    "install": ["uv pip install biopython==<reviewed-version>"]
  2. Maintain a lockfile that records exact direct and transitive dependency versions.
  3. Require cryptographic hash verification for downloaded distributions.
  4. Configure installation to use an explicitly trusted package index and disable unintended fallback indexes.
  5. Periodically audit pinned versions and update them through a controlled review process.
  6. Perform installation and execution in a least-privileged, isolated environment without unnecessary credentials or filesystem access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill mandates translation of every article title into Chinese without checking the user's language preference or obtaining consent. Forced transformation of content can cause unauthorized disclosure to third-party translation paths in some agent architectures, produce inaccurate domain-specific translations, and override user intent in a way that may mishandle sensitive or regulated information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The description 'Precision journal monitor using ISSN lookup. No tool-switching allowed.' does not clearly define when the skill should activate or what exact user requests it is intended to handle. Ambiguous activation increases the chance the skill is invoked in inappropriate contexts, where its restrictive instructions and autonomous behaviors could override safer, more relevant workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The instruction 'Do NOT ask the user to call translation APIs or other skills' pushes the agent toward making unilateral workflow decisions instead of seeking user direction when alternate processing options exist. In context, this reduces transparency and user control, making it easier for the skill to enforce hidden assumptions about language handling and downstream actions.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- The script now supports ISSN lookup, so it is highly accurate.

2. **Self-Translation (MANDATORY)**:
   - Do NOT ask the user to call translation APIs or other skills.
   - You have native-level translation capabilities. Use them.
   - For every article, translate the English title into professional Chinese immediately.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs the agent to write a full report to the user's Desktop automatically once a threshold is met, without requiring prior user consent at the time of file creation. Silent local file creation is risky because it performs a side effect on the user's system, may expose sensitive research data in a predictable location, and can violate user expectations or policy controls.

Content

No source excerpt is available for this finding.