Security audit

academic-suite-v1

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed academic-suite installer, but it force-installs unpinned skills and includes a mandatory academic “de-AI” stage, so users should review it carefully before use.

Install only if you are comfortable allowing this package to install or replace multiple OpenClaw skills. Review each dependency separately, avoid using the --force installer unless you intend to overwrite existing skills, and do not use the humanizer/de-AI stage to hide AI assistance or violate academic disclosure rules. Treat research topics, drafts, uploaded files, IMA paths, and API-backed searches as potentially sensitive unless the dependencies provide clearer privacy controls.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: install.sh:46
Finding: Unpinned and forcibly updated third-party Skill dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 34)May include surrounding context.
text
# dependencies/ # 配置文件（含敏感信息） *.env .env.local config.local.json

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 35)May include surrounding context.
text
# 配置文件（含敏感信息） *.env .env.local config.local.json # 大型文件

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill performs installation of an academic suite and its dependencies. However, the provided code does not install anything, manage dependencies, or execute an academic pipeline. Its primary function is release automation: it checks for the clawhub tool, verifies the user is logged in, confirms required metadata/files exist, prompts the operator, and runs clawhub publish .. That is a materially different purpose from end-user installation, so the description does not accurately represent the behavior of this code chunk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The quickstart guide is presented entirely in Chinese from the title onward, and the example invocation phrases are also Chinese-only. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific context, which can violate language/locale choice expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The guide describes literature search across 'IMA + 8 platforms' but does not clearly warn users that prompts, research topics, uploaded materials, and possibly API-linked knowledge-base contents may be transmitted to external services. In an academic workflow, this can expose unpublished research ideas, thesis drafts, proprietary institutional data, or personal information without informed user consent.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The mandated 'HUMANIZE ✦' / '去 AI 化处理' stage explicitly frames the workflow around removing signs of AI authorship, which supports evasion of AI-detection, academic-integrity checks, and institutional disclosure requirements. In the context of a paper-generation suite, this materially increases the likelihood of deceptive submission and misuse for ghostwriting or policy circumvention.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The statement that 'humanizer only optimizes expression style' narrows the transformation but still preserves the core purpose of disguising AI-generated text while keeping claims, data, and citations intact. Within an academic writing pipeline, this context makes the feature more dangerous because it operationalizes concealment as a standard required stage before finalization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The README is entirely written in Chinese and the usage examples and instructions assume Chinese-language interaction, but there is no indication that this locale restriction is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README says the system will automatically perform literature/API-backed research and generate final deliverables, but it does not disclose what data may be transmitted to external services or what files may be created locally. In an academic workflow, prompts, drafts, references, and potentially sensitive unpublished research could be sent to third-party services or written to disk without informed user consent.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A mandatory '去 AI 化处理' stage explicitly promotes altering AI-generated academic writing so it appears human-authored, which facilitates academic deception and evasion of AI-detection or authenticity review. In the context of an academic writing suite with integrity and review stages, this is especially dangerous because it operationalizes misconduct as a required pipeline step.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The main title and introductory instructions are presented in Chinese, and the usage guidance throughout the file assumes Chinese interaction without stating that other languages are supported. This creates a locale/language policy concern because the skill appears to impose a specific language rather than offering user choice.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
│ ↓ 用户确认 │ │ Stage 2 RESEARCH (deep-research) │ │ ↓ 用户确认 │ │ Stage 3 WRITE (academic-paper) │ │ ↓ 用户确认 │ │ Stage 4 INTEGRITY ✦ 强制 ✦ (引用/数据 100% 验证) │ │ ↓ PASS → 继续；FAIL → 修复重验（最多 3 轮） │

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
│ ↓ 用户确认 │ │ Stage 2 RESEARCH (deep-research) │ │ ↓ 用户确认 │ │ Stage 3 WRITE (academic-paper) │ │ ↓ 用户确认 │ │ Stage 4 INTEGRITY ✦ 强制 ✦ (引用/数据 100% 验证) │ │ ↓ PASS → 继续;FAIL → 修复重验(最多 3 轮) │

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script presents all user-facing instructions, prompts, and status messages in Chinese, including the login confirmation prompt and installation guidance. That forces a specific language/locale on all users without any documented opt-in or alternative, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's user-facing comments and terminal messages are consistently in Chinese, including usage, errors, prompts, and success/failure output. This imposes a specific language on all users without opt-in or any documented locale choice, which matches the policy category for language/locale violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README encourages one-click installation and direct execution of an install script that pulls in many dependent skills, but it does not warn users about filesystem changes, downloaded dependencies, or trust boundaries. This increases the chance that users will run broad installation actions without understanding what is being installed or modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file instructs users to execute an installation script and later suggests using clawhub install ... --force, both of which can modify the local skill environment and overwrite/update installed dependencies. The release notes describe the automation but do not include any user-facing warning that these actions will change the local setup or may replace existing versions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.