ClawHub
Back to skill

Security audit

hfpclawer-formula-verify

Security checks for vulnerabilities and agentic risk

Overview

This formula-checking skill also exposes broader research-tool capabilities, including networked services and Zotero read/write paths, so it needs user review before installation.

Install only if you want the broader hfpclawer research CLI, not just formula checking. Avoid enabling Zotero, LLM, graph, or scholarly API integrations unless you intentionally want those data flows, and review where hfpclawer stores config, registry data, profiles, and generated reports.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as formula verification, but the documentation advertises broader capabilities including Zotero integration, citation graphing, and LLM helpers. This scope expansion can mislead operators about what external services, data flows, or side effects are in play, increasing the chance that an agent invokes unrelated networked features under a narrower trust assumption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Zotero read/write/ingest capability is unrelated to formula verification and introduces unnecessary access to a local bibliographic service. If the underlying CLI honors these capabilities, an agent could read or modify a user's Zotero library or interact with localhost APIs outside the user's expectation for this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The environment section documents unrelated scholarly APIs and a local Zotero service even though the skill's stated purpose is formula verification. In an agent setting with network and file permissions, this broadens the apparent operational envelope and may normalize unnecessary access to local or external endpoints, including localhost services that often expose sensitive data.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill requests shell, file read/write, and network permissions, which are broad for a formula-verification tool. While some of these may be justified for invoking CLIs, generating reports, and optionally contacting Wolfram, the surrounding documentation also references unrelated networked and local-service features, making the permission set more dangerous because it can enable out-of-scope access and persistence.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
tags: [formula-verification, sympy, latex, cas, wolfram]
author: HFPClawer Maintainers
version: 1.2.3
permissions: [shell, file_read, file_write, network]
metadata:
  hermes:
    homepage: https://github.com/diamond2nv/hfpapers-crawler

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents commands that create or modify local files, such as hfpclawer init writing config.yaml. While the examples show the command behavior inline, the skill lacks a clear user-facing caution section warning that running the skill will persist files in the working directory or data directory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes deterministic verification layers using SymPy, Wolfram CAS, and dimensional consistency checks. An opt-in LLM helper capability is not part of that declared purpose and is not justified by the documented verification workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown specifies downloading en_core_web_sm and describes fallback behavior among English spaCy models only. This is a natural-language locale constraint presented as the default behavior, without offering users a language choice or clearly documenting that the capability is English-only by design.

Content

No source excerpt is available for this finding.