Pkg Paper Rewriter Claw

• Outcome: Pass
• Latest audit: Nov 12, 2026 · 8:35 PM UTC
• Version: 5.10.0

Overview

The verdict is benign with medium confidence: scanners report a local writing toolkit whose main risks are mismatches between its preservation claims and some editing and verification behavior, with no harmful behavior established by the reported results.

The benign verdict is not a guarantee of safety, and the scan was partial: 44 of 46 components were fully inspected, two were partial, and the static tool-misuse analyzer was degraded. Before installing, consider whether you are comfortable with the reported gaps in terminology and numeric preservation checks, and review any generated edits and integrity results yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Local terminology scanning and reporting support the declared academic-writing purpose. However, --unify goes beyond detection and deliberately replaces terminology in an output document. Neither the replacement engine nor the custom-pair loader protects numbers, DOIs, PMIDs, or other sensitive spans; replacements are applied wherever matching substrings occur. Replacement logs, conflict checks, and advice to run verify.py afterward provide review assistance, but do not enforce the stated preservation guarantee. No network access is visible in this chunk, and the broader toolkit features absent from this individual script are not themselves treated as mismatches.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

Worked end-to-end examples: `references/examples.md`. Unified exit codes,

User-facing CLI errors are required to be in Chinese without a language choice.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

L047–L049 specify that every user-side exception produces two lines in Chinese. This imposes a fixed output language without user opt-in or a documented region-specific reason, potentially making recovery instructions inaccessible to users working in another language.

Content

No source excerpt is available for this finding.

The shared CLI error format fixes diagnostics to Chinese without user opt-in.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

L263 identifies two-line Chinese errors as the unified format for all CLI tools, and the example demonstrates that fixed-language behavior. Although the stated goal is accessibility for nontechnical users, the text offers no language choice or justification for restricting those users to Chinese.

Content

No source excerpt is available for this finding.

JSON output bypasses the documented failure exit code for statistical-integrity issues.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Both JSON-output branches exit with code 0 even when statistical issues are detected, contradicting the documented 0/1/2 contract. An agent or CI workflow using JSON output but relying on exit status can therefore accept an inconsistent manuscript; the issues remain visible in JSON, so the impact depends on how the caller gates acceptance.

Content

No source excerpt is available for this finding.

The terminology-unification mode changes protected terminology and can modify identifiers despite the manifest's preservation guarantee.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

Unification performs unrestricted substring replacement across the document without protecting identifiers, citations, or longer words containing a matched variant. Although this mode is explicitly requested and reports replacement counts, it can corrupt scientific identifiers or terminology contrary to the preservation guarantee; integrity verification is only recommended afterward, not enforced.

Content

No source excerpt is available for this finding.

Em-dash scoring bypasses the documented safeguards for ordinary punctuation and short texts.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The density-scoring path requires at least 400 English words and three em-dashes, but _score independently adds six points whenever em_dash_density exceeds 6, without either safeguard or short-text discounting. Ordinary punctuation in a short passage can therefore inflate its score and, alongside other signals, change its classification or automated exit verdict. This is a limited scoring-integrity issue rather than code execution or data exposure; the tool's explicit heuristic-only framing reduces its impact.

Content

No source excerpt is available for this finding.

The bundle's claimed complete write audit records only bundle artifacts, omitting other files written during the same run.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest claims to enumerate all writes during the run, but registration covers only bundle artifacts and omits outputs such as the cleaned manuscript, automatic terminology file, revision logs, and handoff file. Consumers relying on this as a complete permissions or filesystem audit receive incomplete evidence, although the omission does not itself grant additional filesystem access.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/reporter.py (reported line 460)May include surrounding context.

python

smps = "".join("<li>%s</li>" % esc(s) for s in c.get("samples", [])[:6])
        rows.append("<details><summary>%s ×%d%s</summary>%s<ul>%s</ul></details>"
                    % (esc(c.get("label", cid)), c.get("count", 0),
                       " [可自动修]" if cid in __import__("hxt_core").AUTO_FIXABLE else "",
                       rat, smps))
    hit_html = ("<div class='card'><h2>命中明细（改稿口径，L=原文行号）</h2>"
                + ("".join(rows) if rows else "<p>未命中任何特征。</p>") + "</div>")

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/reporter.py (reported line 486)May include surrounding context.

python

for cid, c in sorted(cats.items(), key=lambda kv: -kv[1].get("count", 0)):
        label = c.get("label", cid)
        cnt = c.get("count", 0)
        if cid in __import__("hxt_core").AUTO_FIXABLE:
            act_auto.append("<li>%s ×%d → <code>python scripts/transform.py 原稿 -o 改稿.txt</code>（机械层自动处理）</li>"
                            % (esc(label), cnt))
        elif cid.startswith(("chatbot", "cutoff", "model_artifact")):

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/selfcheck.py (reported line 65)May include surrounding context.

python

bad = []
    for m in mods:
        try:
            __import__(m)
        except Exception as e:  # noqa: BLE001 — 自检要兜住任意导入失败
            bad.append("%s(%s)" % (m, str(e)[:40]))
    check("S2.模块导入", not bad, "、".join(bad))

The documented stdout mode never emits the cleaned text.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Without --output, the cleaned text is never emitted: normal mode prints only diagnostic JSON, while quiet mode emits nothing, and both exit successfully. A documented stdout pipeline can therefore replace downstream manuscript content with diagnostics or an empty result, undermining this skill's manuscript-integrity purpose.

Content

No source excerpt is available for this finding.

Numeric integrity comparisons silently discard precision despite the manifest's number-preservation guarantee.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Numeric keys are converted to binary floats and rounded to six decimal places, causing distinct values to compare equal and potentially collapsing large integers as well. Changes to precise measurements or small statistical values can therefore avoid hard numeric violations, making the academic number-preservation guarantee unreliable even though contextual checks may generate warnings.

Content

No source excerpt is available for this finding.

Added numbers do not fail the numeric-multiset integrity requirement documented as a hard red line.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Added numeric tokens produce only W_NUM_ADDED, leaving ok true and the default CLI exit status successful when no other violations occur. Consequently, fabricated numbers can pass an exit-code-based integrity gate despite the documented requirement that numeric multisets remain identical; visible warnings and optional --strict mitigate but do not close the default enforcement gap.

Content

No source excerpt is available for this finding.

CLI error messages are required to use Chinese without a user language choice.

Low

• Category: Output Handling
• Confidence: 95% confidence

Finding

The CliError docstring explicitly requires CLI errors and remediation advice to be presented in Chinese. The shared cli_entry implementation enforces this through fixed Chinese messages, with no language opt-in or locale selection; targeting nontechnical users does not justify a Chinese-only requirement.

Content

No source excerpt is available for this finding.