Auto Research Claw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This is a coherent autonomous research tool, but it runs and delegates high-impact code/agent actions with weak containment and approval controls.

Install only in a disposable or tightly sandboxed environment. Avoid --auto-approve for first runs, prefer Docker with no fallback to local execution, keep API keys out of the inherited environment when running generated code, review any generated ~/.metaclaw/skills content before reuse, and avoid accepting the global opencode-ai@latest install unless you trust that third-party package source.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: researchclaw/experiment/sandbox.py:315

Finding

LLM-Generated Experiment Code Executes in an Unisolated Host Process with Inherited Secrets

Content

View full analysis

Vulnerability Details

File Location: researchclaw/experiment/sandbox.py:315-326, researchclaw/experiment/sandbox.py:408-419, researchclaw/experiment/factory.py:28-34, and config.researchclaw.example.yaml:59-66
Vulnerability Type: Untrusted code execution without an effective sandbox
Risk Level: Critical

Vulnerable Code

researchclaw/experiment/sandbox.py:315-326:

python

result: SandboxResult
try:
    env = {**os.environ, "PYTHONUNBUFFERED": "1"}
    completed = subprocess.run(
        command,
        capture_output=True,
        text=True,
        timeout=timeout_sec,
        cwd=self.workdir,
        env=env,
        check=False,
    )

The same unsafe execution model is used for multi-file projects in researchclaw/experiment/sandbox.py:408-419:

python

result: SandboxResult
try:
    env = {**os.environ, "PYTHONUNBUFFERED": "1"}
    completed = subprocess.run(
        command,
        capture_output=True,
        text=True,
        timeout=timeout_sec,
        cwd=sandbox_project,
        env=env,
        check=False,
    )

Docker failure causes an automatic downgrade to this host process in researchclaw/experiment/factory.py:28-34:

python

if not DockerSandbox.check_docker_available():
    logger.warning(
        "Docker daemon is not reachable — "
        "falling back to subprocess sandbox."
    )
    return ExperimentSandbox(config.sandbox, workdir)

The distributed example configuration selects the local execution mode:

yaml

experiment:
  # ★ mode 决定实验结果的真实性
  #   "sandbox"   — 在本地沙盒中实际执行生成的 Python 代码，产出真实实验数据
  #   "docker"    — 在 Docker 容器中执行，支持 GPU 直通、依赖自动安装、内存隔离
  #   "simulated" — 不执行代码，使用公式生成假数据（仅用于框架开发调试，不应用于论文生成）
  mode: "sandbox"

Technical Analysis

ExperimentSandbox is named as a sandbox but is an ordinary Python subprocess running with the current user's operating-sys ...[truncated 2520 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic Docker-to-host fallback. If an isolated backend is unavailable, fail closed and require an explicit, separate unsafe-mode confirmation.
2. Do not describe an ordinary subprocess as a sandbox.
3. Execute generated code only in a container, micro-VM, or dedicated remote worker with:
   • No network by default.
   • A read-only root filesystem.
   • A minimal writable output mount.
   • A non-root user and dropped Linux capabilities.
   • no-new-privileges, syscall filtering, process limits, memory limits, and time limits.
   • No host socket, SSH agent, home directory, or credential mounts.
4. Build a minimal environment allowlist instead of copying os.environ. Pass only non-sensitive variables required by the experiment.
5. Keep AST validation as defense in depth only. Improve alias and data-flow handling, but never rely on static filtering to contain hostile Python.
6. Centralize all generated-code execution behind one mandatory policy gate so direct callers cannot bypass validation and isolation.
7. Make Docker or equivalent isolation the secure default in generated configuration.
8. Add regression tests proving that generated code cannot read parent environment secrets, access files outside the workspace, open network connections, or spawn unrestricted subprocesses.

T09 · Insecure Skill Coding Practices

Error

• Location: researchclaw/agents/figure_agent/renderer.py:253

Finding

Unvalidated LLM-Generated Plotting Scripts Fall Back to Direct Host Execution

Content

View full analysis

Vulnerability Details

File Location: researchclaw/agents/figure_agent/renderer.py:75-95, researchclaw/agents/figure_agent/renderer.py:200-216, and researchclaw/agents/figure_agent/renderer.py:253-274
Vulnerability Type: Unsafe execution of generated visualization code
Risk Level: Critical

Vulnerable Code

Backend selection in researchclaw/agents/figure_agent/renderer.py:75-95:

python

# Auto-detect Docker availability if not explicitly set
if use_docker is None:
    self._use_docker = _docker_available()
else:
    self._use_docker = use_docker

if self._use_docker:
    self.logger.info(
        "RendererAgent: Docker sandbox ENABLED (image=%s)",
        self._docker_image,
    )
else:
    self.logger.warning(
        "RendererAgent: Docker sandbox DISABLED — LLM-generated "
        "scripts will run as LOCAL subprocesses WITHOUT sandboxing. "
        "Set use_docker=True or install Docker for secure execution."
    )

Generated code is saved and routed to the local backend in researchclaw/agents/figure_agent/renderer.py:200-216:

python

script_path.write_text(script_code, encoding="utf-8")
result["script_path"] = str(script_path)

# Choose execution backend
if self._use_docker:
    proc_result = self._execute_in_docker(
        script_path=script_path,
        output_dir=output_dir,
        figure_id=figure_id,
    )
else:
    proc_result = self._execute_local(
        script_path=script_path,
        output_dir=output_dir,
    )

Direct host execution in researchclaw/agents/figure_agent/renderer.py:253-274:

python

def _execute_local(
    self,
    *,
    script_path: Path,
    output_dir: Path,
) -> dict[str, str]:
    """Execute script in a local subprocess (no sandbox)."""
    try:
        proc = subprocess.run(
            [self._python, str(script_path.resolve())],
            capture_output=True,
    
...[truncated 2252 chars]

Remediation

View remediation

Remediation Suggestions

1. Delete the automatic local fallback for LLM-generated scripts. Return a security error when an isolated renderer is unavailable.
2. Require explicit user authorization for any deliberately unsafe local mode, and keep it disabled by default.
3. Use the existing container backend with mandatory restrictions:
   • No network.
   • Read-only root filesystem.
   • Non-root execution.
   • Only the script as a read-only input and the figure directory as a writable output.
   • Dropped capabilities, no-new-privileges, PID limits, and resource limits.
4. Validate generated plotting code before execution, while treating validation only as an additional layer rather than the isolation boundary.
5. Prefer a declarative chart specification interpreted by trusted renderer code instead of allowing the LLM to generate arbitrary Python.
6. Ensure container availability and the required image are checked before the pipeline begins, not after generated code has already been accepted.
7. Add tests demonstrating that plotting code cannot access environment secrets, external files, the network, or process-execution APIs.

T02 · Agent Memory Poisoning

Error

• Location: researchclaw/metaclaw_bridge/lesson_to_skill.py:109

Finding

LLM-Generated Lessons Are Persisted as Active Cross-Session Skill Instructions Without Approval

Content

View full analysis

Vulnerability Details

File Location: researchclaw/metaclaw_bridge/lesson_to_skill.py:109-129, researchclaw/metaclaw_bridge/lesson_to_skill.py:175-211, researchclaw/pipeline/runner.py:1411-1438, and researchclaw/config.py:451-475
Vulnerability Type: Persistent instruction and memory poisoning
Risk Level: High

Vulnerable Code

Skill content is written directly in researchclaw/metaclaw_bridge/lesson_to_skill.py:109-129:

python

def _write_skill(skills_dir: Path, skill: dict[str, str]) -> Path | None:
    """Write a single skill to disk as a SKILL.md file."""
    name = skill["name"]
    # Sanitize name
    name = re.sub(r"[^a-z0-9-]", "-", name.lower()).strip("-")
    if not name:
        return None

    skill_dir = skills_dir / name
    skill_dir.mkdir(parents=True, exist_ok=True)
    skill_path = skill_dir / "SKILL.md"

    content = f"---\nname: {name}\n"
    content += f"description: {skill['description']}\n"
    content += "metadata:\n"
    content += f"  category: {skill['category']}\n"
    content += f"---\n{skill['content']}\n"

    skill_path.write_text(content, encoding="utf-8")
    logger.info("Created new MetaClaw skill: %s", name)
    return skill_path

The post-pipeline hook invokes conversion and writes into the configured active Skill directory in researchclaw/pipeline/runner.py:1411-1438:

python

bridge = getattr(config, "metaclaw_bridge", None)
if not bridge or not getattr(bridge, "enabled", False):
    return

from researchclaw.llm.client import LLMClient

# 1. Lesson-to-skill conversion
l2s = getattr(bridge, "lesson_to_skill", None)
if l2s and getattr(l2s, "enabled", False) and lessons:
    try:
        from researchclaw.metaclaw_bridge.lesson_to_skill import (
            convert_lessons_to_skills,
        )

        min_sev = getattr(l2s, "min_severity", "warning")
        llm = LLMClient.from_rc_config(config)
        n
...[truncated 3113 chars]

Remediation

View remediation

Remediation Suggestions

1. Write generated Skills to a quarantine or draft directory that is never automatically loaded.
2. Require explicit human review and approval before promotion into an active Skill directory.
3. Display the complete generated instruction text, its originating lessons, source documents, run identifier, and model metadata during review.
4. Validate both YAML metadata and Markdown content. Reject policy-override language, hidden instructions, unsafe tool directives, secret-access requests, and encoded or obfuscated payloads.
5. Escape or safely serialize YAML fields rather than concatenating untrusted strings.
6. Restrict generated Skills to a typed, declarative schema of allowed research guidance instead of arbitrary Markdown instructions.
7. Record immutable provenance and a cryptographic digest for each approved Skill.
8. Prevent generated Skills from granting themselves access to additional tools or changing security policy.
9. Make lesson-to-Skill conversion separately disabled by default, even when the broader MetaClaw bridge is enabled.
10. Provide revocation, rollback, expiration, and duplicate/conflict detection for persistent Skills.

T08 · Insecure Dependencies

Warning

• Location: researchclaw/cli.py:45

Finding

Interactive Setup Installs a Mutable Unpinned npm Package Globally

Content

View full analysis

Vulnerability Details

File Location: researchclaw/cli.py:45-61, researchclaw/cli.py:68-111, and SKILL.md:12-19
Vulnerability Type: Unsafe global dependency installation
Risk Level: Medium

Vulnerable Code

Global installation in researchclaw/cli.py:45-61:

python

def _install_opencode() -> bool:
    """Install OpenCode globally via npm.  Returns True on success."""
    print("  Installing opencode-ai (this may take a minute)...")
    npm_cmd = shutil.which("npm")
    if not npm_cmd:
        print("  npm is not installed. Cannot install OpenCode.")
        return False
    try:
        r = subprocess.run(
            [npm_cmd, "i", "-g", "opencode-ai@latest"],
            capture_output=True, text=True, timeout=120,
        )
        if r.returncode == 0:
            print("  OpenCode installed successfully!")
            return True

The installation prompt defaults to acceptance in researchclaw/cli.py:99-106:

python

try:
    answer = input("  Install OpenCode now? [Y/n]: ").strip().lower()
except (EOFError, KeyboardInterrupt):
    print()
    return False

if answer in ("", "y", "yes"):
    success = _install_opencode()

The Skill installation instructions invoke setup in SKILL.md:12-19:

bash

cd ~/.openclaw/skills/auto-research-claw
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
./researchclaw setup

Technical Analysis

The setup command offers to install opencode-ai@latest globally through npm. The latest tag is mutable, so the package content executed by future installations is not the same fixed artifact reviewed with this Skill. npm packages can run lifecycle scripts during installation, and global installation extends effects beyond the project virtual environment.

The installation is interactive rather than silent, which reduces severity. However, the prompt presents the component as recomme ...[truncated 1355 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin OpenCode to a reviewed exact version rather than using @latest.
2. Verify the downloaded package using registry integrity metadata, a lockfile, a trusted signature, or a documented digest.
3. Install the tool into a project-local directory or isolated tool environment instead of globally.
4. Do not invoke npm with elevated permissions.
5. Consider disabling lifecycle scripts during installation and explicitly running only reviewed setup steps afterward.
6. Change the prompt to an explicit opt-in default, such as [y/N], and explain that third-party code will be downloaded and executed.
7. Separate optional third-party tool installation from the standard researchclaw setup path.
8. Maintain an allowlisted and reviewed version range with a documented update process.
9. Audit transitive dependencies and publish a software bill of materials for the optional toolchain.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (632)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The one-command example promotes immediate execution with --auto-approve, while elsewhere the README describes cloning, installing, configuring, running experiments, generating files, and using network-backed literature sources. For a markdown skill description, this lacks an upfront warning that the command may perform autonomous actions affecting the local system, filesystem, and external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that after saying "Research [your topic]", OpenClaw will automatically clone the repository, install dependencies, set up config, and execute the pipeline. This is a safety-significant behavior affecting system state, but the markdown does not include a conspicuous warning or caution before presenting it as "That's it."

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.researchclaw.example.yaml (reported line 90)May include surrounding context.

yaml

host: ""                # SSH hostname or IP
    user: ""                # SSH username (default: current user)
    port: 22                # SSH port
    key_path: ""            # Path to private key (default: ~/.ssh/id_rsa)
    gpu_ids: []             # e.g. [0, 1] for CUDA_VISIBLE_DEVICES
    remote_workdir: "/tmp/researchclaw_experiments"
    remote_python: "python3"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.researchclaw.example.yaml (reported line 122)May include surrounding context.

yaml

host: ""                # SSH hostname or IP
    user: ""                # SSH username (default: current user)
    port: 22                # SSH port
    key_path: ""            # Path to private key (default: ~/.ssh/id_rsa)
    gpu_ids: []             # e.g. [0, 1] for CUDA_VISIBLE_DEVICES
    remote_workdir: "/tmp/researchclaw_experiments"
    remote_python: "python3"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.researchclaw.example.yaml (reported line 132)May include surrounding context.

yaml

host: ""                # SSH hostname or IP
    user: ""                # SSH username (default: current user)
    port: 22                # SSH port
    key_path: ""            # Path to private key (default: ~/.ssh/id_rsa)
    gpu_ids: []             # e.g. [0, 1] for CUDA_VISIBLE_DEVICES
    remote_workdir: "/tmp/researchclaw_experiments"
    remote_python: "python3"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section says OpenClaw will automatically clone the repository, install packages, configure settings, request or use API keys, run the pipeline, and return results, but it presents that behavior as effortless chat-driven automation without an explicit caution. Those actions can modify the system, consume credentials, and run substantial workloads, so the README should clearly disclose the risks before encouraging use.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example prompt tells the user to include 'My API key is: sk-xxxx' when interacting with Claude Code. Even though it adds 'set it as an environment variable, don't hardcode it,' the natural-language instruction still encourages disclosure of a secret to another AI system as part of the conversation, which is a data-leak pattern conveyed semantically rather than through technical exfiltration code.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that research conversations will be used for continuous fine-tuning, and later sections describe session tracking, lesson extraction, skill generation, and RL training data collection. These behaviors can capture and retain user-provided content, but the markdown does not warn users about data retention, secondary use for training, or the need to avoid sensitive data.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · docs/sandbox_environment_fix_plan.md (reported line 229)May include surrounding context.

CMD ["main.py"]

text

Note: For `setup_only` network policy, the container needs `--cap-add=NET_ADMIN` for iptables,
or we use `ip route del default` as a fallback (doesn't require capabilities).

**E2.3: Refactor `docker_sandbox.py`**

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · docs/integration-guide.md (reported line 479)May include surrounding context.

md

# For setup_only: container starts with network, then disables it internally
    if cfg.network_policy == "setup_only":
        cmd.extend(["-e", "RC_SETUP_ONLY_NETWORK=1"])
        cmd.extend(["--cap-add=NET_ADMIN"])
        # Don't add --network none (need network for setup phases)
    elif cfg.network_policy == "none":
        cmd.extend(["--network", "none"])

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · docs/sandbox_environment_fix_plan.md (reported line 255)May include surrounding context.

md

# For setup_only: container starts with network, then disables it internally
    if cfg.network_policy == "setup_only":
        cmd.extend(["-e", "RC_SETUP_ONLY_NETWORK=1"])
        cmd.extend(["--cap-add=NET_ADMIN"])
        # Don't add --network none (need network for setup phases)
    elif cfg.network_policy == "none":
        cmd.extend(["--network", "none"])

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · researchclaw/experiment/docker_sandbox.py (reported line 385)May include surrounding context.

python

# For setup_only: container starts with network, then disables it internally
    if cfg.network_policy == "setup_only":
        cmd.extend(["-e", "RC_SETUP_ONLY_NETWORK=1"])
        cmd.extend(["--cap-add=NET_ADMIN"])
        # Don't add --network none (need network for setup phases)
    elif cfg.network_policy == "none":
        cmd.extend(["--network", "none"])

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · researchclaw/cli.py (reported line 848)May include surrounding context.

python

init_p = sub.add_parser("init", help="Create config.arc.yaml from example template")
    _ = init_p.add_argument(
        "--force", action="store_true", help="Overwrite existing config.arc.yaml"
    )

    _ = sub.add_parser("setup", help="Check and install optional tools (OpenCode, etc.)")

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code reads arbitrary SKILL.md content from arc-* directories and appends that natural-language text directly into a future-stage overlay with instructions to apply it proactively. Semantically, this creates a channel for prior-run text to carry hidden behavior-shaping or data-leaking instructions into later model prompts, even if the text avoids obvious jailbreak keywords.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · researchclaw/experiment/code_agent.py (reported line 427)May include surrounding context.

python

stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            cwd=workdir,
            env={**os.environ},
            start_new_session=True,
        )
        try:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The shared prompts tell the coding agent that subprocesses, os.system, and similar capabilities are forbidden, implying a constrained code-editing role. However, the ClaudeCodeAgent launches the CLI with --dangerously-skip-permissions and --allowed-tools Bash Edit Write Read, which actively enables shell-capable behavior rather than enforcing the documented restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring describes a 'Sandbox environment for safe experiment code execution', implying isolation and safety guarantees. In practice, the implementation runs arbitrary Python via subprocess and passes nearly the full host environment through env = {**os.environ, ...} at L320-L328 and L417-L425, which is not a strong safety boundary and can expose host secrets or capabilities to the executed code.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · researchclaw/experiment/sandbox.py (reported line 320)May include surrounding context.

python

result: SandboxResult
        try:
            env = {**os.environ, "PYTHONUNBUFFERED": "1"}
            completed = subprocess.run(
                command,
                capture_output=True,

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · researchclaw/experiment/sandbox.py (reported line 417)May include surrounding context.

python

result: SandboxResult
        try:
            env = {**os.environ, "PYTHONUNBUFFERED": "1"}
            completed = subprocess.run(
                command,
                capture_output=True,

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The subprocess environment is built from os.environ, which exposes all inherited environment variables to the executed code. This is safety-relevant because untrusted experiment code may read sensitive credentials or configuration from the environment, yet this file provides no user-facing warning or explicit disclosure of that behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file primarily frames the task as reading tester feedback, comparing it to current code, and generating a bug-fix document. However, the final step expands the agent's role into changing repository state and publishing directly to the remote main branch, which is a materially stronger capability than analysis/report generation and is not otherwise justified by the stated workflow purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The client invokes the external ACP agent with the --approve-all flag, which removes interactive approval safeguards for whatever actions the agent may perform. Although subprocess execution is central to this client's purpose, the code does not disclose to the user that approval checks are being bypassed for agent actions.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The short prompt tells the agent to read a file in its entirety, 'Follow ALL instructions contained in that file,' and 'respond exactly as requested.' Semantically, this is a prompt-injection sink because it delegates authority to external natural-language content wholesale, allowing embedded instructions in the file to redirect behavior or override safer operating constraints.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · researchclaw/pipeline/code_agent.py (reported line 1119)May include surrounding context.

python

code_lines = code.split("\n")
        total_lines = len(code_lines)

        # Extract context window: ±30 lines around error
        window = 30
        start = max(0, error_line - window - 1)
        end = min(total_lines, error_line + window)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · researchclaw/pipeline/opencode_bridge.py (reported line 460)May include surrounding context.

python

prompt: str,
    ) -> tuple[bool, str, float]:
        """Run ``opencode run`` in the workspace. Returns (success, log, elapsed)."""
        env = os.environ.copy()
        # Pass API key via environment if configured
        if self._api_key_env:
            api_key = os.environ.get(self._api_key_env, "")

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: researchclaw/prompts.py:1298

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docs/TESTER_GUIDE_JA.md:185

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docs/TESTER_GUIDE.md:185

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/agents/figure_agent/orchestrator.py:176

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/cli.py:741

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/health.py:583

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/llm/client.py:152

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/pipeline/stage_impls/_analysis.py:649

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: researchclaw/pipeline/stage_impls/_literature.py:359