ClawHub
Back to skill

Security audit

Clarity Literature

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed Clarity Protocol literature lookups with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Before installing, understand that this skill may contact clarityprotocol.io and, if CLARITY_API_KEY is set, will send that key to the Clarity API. Treat its search capability as a database listing tool unless the provider adds real keyword or filtered search.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The code aligns with the 'get paper details by PMID' portion of the description: it accepts a PMID, calls the literature API for that PMID, and prints publication metadata and abstract details. However, the declared purpose also prominently includes searching research papers and lists 'search papers' as a capability. No search behavior appears in this code chunk. This is a description-behavior mismatch because the declared capabilities overstate what this specific code actually does.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The code generally matches the stated domain and resource: it accesses Clarity Protocol literature data and outputs publication information. However, the declared capabilities include getting paper details by PMID, which this code does not implement. It also does not support actual user-driven searching or filtering; it simply fetches the /literature listing endpoint and prints results. So the description overstates the implemented functionality enough to count as a mismatch.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares internet access and optional use of an environment variable API key, but it does not explicitly scope or constrain those capabilities with a permissions or allowed-tools section. That makes the operational boundary unclear to the agent runtime and reviewers, increasing the risk of unintended network access or secret exposure through overly broad execution privileges.

Vague Triggers

Low
Confidence
84% confidence
Finding
The invocation guidance includes broad phrases like 'search research papers' and 'literature about protein' without negative examples or explicit scope limits. This could cause unintended activation for general literature or protein-related queries beyond the intended Clarity Protocol literature search use case.

Static analysis

No suspicious patterns detected.