Security audit

Paper Digest

Security checks for vulnerabilities and agentic risk

Overview

This arXiv summarizer appears purpose-built, but it needs Review because remote paper content and extracted IDs can drive sub-agents, web requests, and persistent local file writes without clear validation or instruction isolation.

Install only if you are comfortable with the skill contacting arXiv, spawning sub-agents for citations, and storing paper-derived summaries in your OpenClaw workspace. Prefer adding strict arXiv ID validation, explicit untrusted-content handling, and cleanup or confirmation controls before broad use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:13
Finding: Indirect Prompt Injection Through Untrusted Paper Content
Content: View full analysis
- If HTTP 200 → use this as `paper_text`. - If Falis: add v1 at the end, and try again: web.fetch https://arxiv.org/html/v1 - else if all fails skip and ABORT! If the `paper_text` is retrieved then write the summary to `~/.openclaw/workspace/papers/.md`. ## Step 2 — Extract citations Note: DO NOT DO THIS STEP INSIDE sub-agents Within the `main agent` and from `paper_text`, identify **at most 5 citations** the paper most directly builds on. Prioritize: - Papers that are **explicitly extended** or improved upon - Papers used as the **primary baseline** for comparison - Papers that **provide the core architecture** this work adopts - Papers **referred to repeatedly** (not just mentioned once) or that provide essential context For each citation, extract either the `arXiv ID` or the **title**. Then resolve to an arXiv URL: - If an arXiv ID is in the reference → `https://arxiv.org/html/` - Otherwise search `https://arxiv.org/search/?query=&searchtype=all` and take the first match. ``` ```markdown Check the citation summaries within `~/.openclaw/workspace/papers/` then utilize the main paper we are summarising with citation summaries and write a single **markdown document in flowing prose** (no bullet lists) to `~/.openclaw/workspace/digest/report_<arxiv-id>`. ``` ### Technical Analysis The skill directs the agent to fetch remote paper pages and use their contents as `paper_text`. That content is then interpreted directly by the main agent for citation extraction and final report generation. Citation summaries derived from additional remote documents ...[truncated 2165 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:10
Finding: Unvalidated arXiv Identifier Used in URLs and Filesystem Paths
Content: View full analysis
- If HTTP 200 → use this as `paper_text`. - If Falis: add v1 at the end, and try again: web.fetch https://arxiv.org/html/v1 - else if all fails skip and ABORT! If the `paper_text` is retrieved then write the summary to `~/.openclaw/workspace/papers/.md`. ``` ```markdown For each resolved citation: - Check if the file for citation exists: `~/.openclaw/workspace/papers/.md`, if it does then skip and consider the sub-agent concluded. - If the previous step fails then spawn a sub-agent with this EXACT instruction in VERBATIM: - Fetch https://arxiv.org/html/ (or add v1 at the end, and try again: web.fetch https://arxiv.org/html/v1). If unavailable, SKIP. If retrieved then Write the summary to `~/.openclaw/workspace/papers/.md`. ``` ```markdown Check the citation summaries within `~/.openclaw/workspace/papers/` then utilize the main paper we are summarising with citation summaries and write a single **markdown document in flowing prose** (no bullet lists) to `~/.openclaw/workspace/digest/report_`. ``` ### Technical Analysis The input instructions only require stripping an expected URL prefix and extracting a bare identifier. They do not define a strict accepted grammar or require rejection of path separators, traversal sequences, encoded delimiters, query strings, fragments, control characters, or alternative URL forms. The resulting value is interpolated into both remote URLs and local filesyste ...[truncated 2081 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill is designed to persist generated summaries under fixed paths in the user's home workspace and to reuse those files for later runs, which creates session persistence. This can retain sensitive reading history or derived content longer than intended and allows future tasks or agents to consume prior artifacts without fresh user awareness.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: paper-digest description: "Given an arXiv ID or URL, fetch the paper, spawn sub-agents to read its key citations, and write an executive summary under." user-invocable: true author: Damoon version: 0.0.1

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description says the skill runs when given an arXiv ID or URL, but it does not define specific trigger phrases, invocation boundaries, or exclusions. In a manifest file, this kind of broad natural-language description can overlap with many ordinary research-assistance requests and may cause unintended activation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill performs external network fetches to arXiv and search endpoints without clearly informing the user. Undisclosed outbound requests can expose user interests or proprietary paper selections to third parties and may violate user expectations or environment policies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill writes fetched paper summaries to persistent user-local directories without any disclosure or consent checkpoint. Persistent writes can surprise users, leak research interests into local artifacts, and create unintended retention of content across sessions or later agent runs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.