hfpclawer-formula-verify

• Outcome: Review
• Latest audit: Sep 22, 2026 · 3:48 AM UTC
• Version: 0.19.4

Overview

This formula-checking skill also exposes broader research-tool capabilities, including networked services and Zotero read/write paths, so it needs user review before installation.

Install only if you want the broader hfpclawer research CLI, not just formula checking. Avoid enabling Zotero, LLM, graph, or scholarly API integrations unless you intentionally want those data flows, and review where hfpclawer stores config, registry data, profiles, and generated reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as formula verification, but the documentation advertises broader capabilities including Zotero integration, citation graphing, and LLM helpers. This scope expansion can mislead operators about what external services, data flows, or side effects are in play, increasing the chance that an agent invokes unrelated networked features under a narrower trust assumption.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Zotero read/write/ingest capability is unrelated to formula verification and introduces unnecessary access to a local bibliographic service. If the underlying CLI honors these capabilities, an agent could read or modify a user's Zotero library or interact with localhost APIs outside the user's expectation for this skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The environment section documents unrelated scholarly APIs and a local Zotero service even though the skill's stated purpose is formula verification. In an agent setting with network and file permissions, this broadens the apparent operational envelope and may normalize unnecessary access to local or external endpoints, including localhost services that often expose sensitive data.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

tags: [formula-verification, sympy, latex, cas, wolfram]
author: HFPClawer Maintainers
version: 1.2.3
permissions: [shell, file_read, file_write, network]
metadata:
  hermes:
    homepage: https://github.com/diamond2nv/hfpapers-crawler

• Confidence: 86% confidence
• Finding: The skill requests shell, file read/write, and network permissions, which are broad for a formula-verification tool. While some of these may be justified for invoking CLIs, generating reports, and optionally contacting Wolfram, the surrounding documentation also references unrelated networked and local-service features, making the permission set more dangerous because it can enable out-of-scope access and persistence.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: This markdown file documents commands that create or modify local files, such as `hfpclawer init` writing `config.yaml`. While the examples show the command behavior inline, the skill lacks a clear user-facing caution section warning that running the skill will persist files in the working directory or data directory.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest describes deterministic verification layers using SymPy, Wolfram CAS, and dimensional consistency checks. An opt-in LLM helper capability is not part of that declared purpose and is not justified by the documented verification workflow.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The markdown specifies downloading `en_core_web_sm` and describes fallback behavior among English spaCy models only. This is a natural-language locale constraint presented as the default behavior, without offering users a language choice or clearly documenting that the capability is English-only by design.

Static analysis

No suspicious patterns detected.