ClawHub
Back to skill

Security audit

ResearchClaw

Security checks for vulnerabilities and agentic risk

Overview

ResearchClaw is purpose-aligned as an autonomous research pipeline, but it recommends unattended approvals while supporting execution of generated code locally or over SSH.

Install only if you are comfortable with an autonomous research tool that may create files and run generated experiment code. Keep manual gate review enabled, prefer simulated mode unless you have a real sandbox, use environment variables for API keys, and use a restricted disposable account and workspace for any SSH or subprocess execution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:42
Finding

Automatic Approval Enables Unreviewed Execution of LLM-Generated Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:35
Finding

API Keys May Be Stored in Plaintext Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description advertises a fully autonomous pipeline with 'no babysitting required' but does not warn users that the workflow may generate and execute code, write artifacts to disk, and support SSH-based remote execution. This creates a consent and safety gap where users may invoke the skill without understanding that it can perform risky actions beyond simple text generation.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High
Category
Output Handling
Confidence
96% confidence
Finding

The skill explicitly supports executing generated code locally via subprocess and remotely over SSH, creating a classic untrusted-output-to-execution path. Generated experiment code is influenced by prompts, model behavior, and possibly external literature inputs, so executing it without strong validation or isolation can lead to arbitrary command execution, data exfiltration, or compromise of local/remote environments.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
| Mode | Description | Config |
|------|-------------|--------|
| `simulated` | LLM generates synthetic results (no code execution) | `experiment.mode: simulated` |
| `sandbox` | Execute generated code locally via subprocess | `experiment.mode: sandbox` |
| `ssh_remote` | Execute on remote GPU server via SSH | `experiment.mode: ssh_remote` |

### Troubleshooting

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to activate this highly privileged skill for ordinary requests like 'research' or 'write a paper,' increasing the chance the agent invokes an autonomous pipeline unexpectedly. In this skill, that risk is amplified because activation can lead to file writes, generated code execution, and even remote SSH execution paths.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Using --auto-approve directly in the primary example operationalizes unattended progression through safety checkpoints. Because this skill is explicitly autonomous and execution-capable, the context makes this more dangerous than in a read-only analysis tool.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Option A: CLI (recommended)

bash
researchclaw run --topic "Your research topic here" --auto-approve

Options:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Using --auto-approve directly in the primary example operationalizes unattended progression through safety checkpoints. Because this skill is explicitly autonomous and execution-capable, the context makes this more dangerous than in a read-only analysis tool.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Option A: CLI (recommended)

bash
researchclaw run --topic "Your research topic here" --auto-approve

Options:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill recommends --auto-approve and describes bypassing gates 'without human input' without a strong warning about the purpose of those review gates. That weakens a built-in safety control intended to pause risky autonomous actions, especially in a pipeline that can generate and execute code.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The option description for --auto-approve removes ambiguity that human review can be bypassed, which is a meaningful control-loss issue in this context. Since the pipeline may proceed to code execution and remote operations, the context increases the severity of autonomous approval.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- `--config` / `-c`: Config file path (default: `config.yaml`)
- `--output` / `-o`: Output directory (default: `artifacts/rc-YYYYMMDD-HHMMSS-HASH/`)
- `--from-stage`: Resume from a specific stage (e.g., `PAPER_OUTLINE`)
- `--auto-approve`: Auto-approve gate stages (5, 9, 20) without human input

**Option B: Python API**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The option description for --auto-approve removes ambiguity that human review can be bypassed, which is a meaningful control-loss issue in this context. Since the pipeline may proceed to code execution and remote operations, the context increases the severity of autonomous approval.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- `--config` / `-c`: Config file path (default: `config.yaml`)
- `--output` / `-o`: Output directory (default: `artifacts/rc-YYYYMMDD-HHMMSS-HASH/`)
- `--from-stage`: Resume from a specific stage (e.g., `PAPER_OUTLINE`)
- `--auto-approve`: Auto-approve gate stages (5, 9, 20) without human input

**Option B: Python API**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The option description for --auto-approve removes ambiguity that human review can be bypassed, which is a meaningful control-loss issue in this context. Since the pipeline may proceed to code execution and remote operations, the context increases the severity of autonomous approval.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- `--config` / `-c`: Config file path (default: `config.yaml`)
- `--output` / `-o`: Output directory (default: `artifacts/rc-YYYYMMDD-HHMMSS-HASH/`)
- `--from-stage`: Resume from a specific stage (e.g., `PAPER_OUTLINE`)
- `--auto-approve`: Auto-approve gate stages (5, 9, 20) without human input

**Option B: Python API**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The Python API example sets auto_approve_gates=True, encouraging integrators to embed unattended approval into their own automation. This spreads the unsafe default into downstream usage where users may not realize safeguards have been disabled.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
run_id="research-001",
    config=config,
    adapters=AdapterBundle(),
    auto_approve_gates=True,
)

# Check results

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Suggesting --auto-approve in troubleshooting lowers the barrier to disabling safeguards after a rejection event, which is exactly when caution is most needed. In this skill's context, a rejected gate may be the last stop before unsafe code or remote execution occurs.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
- **Config validation error**: Run `researchclaw validate --config config.yaml`
- **LLM connection failure**: Check `llm.base_url` and API key
- **Sandbox execution failure**: Verify `experiment.sandbox.python_path` exists and has numpy installed
- **Gate rejection**: Use `--auto-approve` or manually approve at stages 5, 9, 20

## Tools Required

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
82% confidence
Finding

Suggesting --auto-approve in troubleshooting lowers the barrier to disabling safeguards after a rejection event, which is exactly when caution is most needed. In this skill's context, a rejected gate may be the last stop before unsafe code or remote execution occurs.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
- **Config validation error**: Run `researchclaw validate --config config.yaml`
- **LLM connection failure**: Check `llm.base_url` and API key
- **Sandbox execution failure**: Verify `experiment.sandbox.python_path` exists and has numpy installed
- **Gate rejection**: Use `--auto-approve` or manually approve at stages 5, 9, 20

## Tools Required