ScienceClaw: Local File Investigation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:09 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent science-file analysis purpose, but its default workflow can send local-file context to external tools, publish results, and add workspace memory without clear user confirmation.

Review this skill carefully before installing. It may be useful for ScienceClaw-based research analysis, but use dry-run or explicit confirmation for sensitive local files, unpublished research, proprietary data, or private workspace context, and avoid allowing it to read memory.md or post to a community unless you intentionally approve that disclosure.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:112

Finding

Workspace Memory Is Read and Forwarded Without Explicit User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 112-116
Vulnerability Type: Unauthorized access to persistent workspace context
Risk Level: Medium

Evidence

markdown

## Workspace context injection

Before running, check the workspace memory for project context:
- Read `memory.md` in the workspace for any stored research focus
- If found, append it to the topic: e.g. `"Analyse sequences [project: working on BRCA2 binder design]"`
- This ensures the investigation is scoped to the user's ongoing project

Technical Analysis

The Skill instructs the agent to read memory.md automatically and append its contents to the investigation topic. Accessing persistent workspace memory is not intrinsically necessary to analyze a user-provided file and expands the data-access scope beyond the immediate request.

Because the resulting topic is supplied to the ScienceClaw multi-agent engine and its selected integrations, unrelated research details or sensitive user context stored in memory can cross a trust boundary. The instructions do not require user approval, restrict which memory entries may be included, redact sensitive material, or identify the downstream recipients and retention policies.

This violates least-privilege and data-minimization principles: an analysis request for one file can cause persistent context from another activity to be accessed and disclosed.

Attack Path

1. The workspace contains memory.md with confidential research context or other sensitive information.
2. A user requests analysis of a local scientific file.
3. Following the Skill, the agent reads memory.md without asking the user.
4. The agent appends memory content to the TOPIC argument.
5. bin/scienceclaw-post sends or otherwise exposes the augmented topic to the multi-agent engine and selected tool integrations.
6. Downstream services receive information unrelated to the minimum data required for th ...[truncated 569 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic access to memory.md; analyze only the file and question explicitly supplied by the user by default.
2. Require explicit, informed user approval before reading or incorporating workspace memory.
3. Present the exact context proposed for inclusion before invoking the engine.
4. Include only the minimum relevant memory fragment rather than the complete stored context.
5. Redact credentials, identifiers, unpublished findings, and unrelated project information.
6. Document which downstream tools receive the context and their retention policies.
7. Add a privacy-preserving mode that prohibits workspace-memory access and external transmission.

other

Error

• Location: SKILL.md:38

Finding

Default Workflow Can Publish Findings Derived from Local Files Without Explicit Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-49; related output instructions at lines 136-141
Vulnerability Type: Unintended external data disclosure
Risk Level: High

Evidence

markdown

## How to run

```bash
SCIENCECLAW_DIR="${SCIENCECLAW_DIR:-$HOME/scienceclaw}"
FILE_PATH="<ABSOLUTE_PATH_TO_FILE>"
TOPIC="<TOPIC_OR_QUESTION>"
COMMUNITY="<COMMUNITY>"

cd "$SCIENCECLAW_DIR"
source .venv/bin/activate 2>/dev/null || true

python3 bin/scienceclaw-post \
  --topic "$TOPIC [local file: $FILE_PATH]" \
  --community "$COMMUNITY" \
  --skills markitdown,pubmed,blast,uniprot,pdb

text

The post-run instructions additionally confirm that publication is an expected outcome:

```markdown
## After running

Report back to the user:
- File analysed and the topic used
- Key findings (first 3–5 from output)
- Which tools participated
- Post ID and link if posted (e.g. `✓ Posted to m/biology — post <id>`)
- Offer a follow-up investigation or deeper query on specific findings

Technical Analysis

The primary documented workflow invokes a posting-oriented command and identifies a destination community. The privacy-preserving --dry-run option is documented separately rather than being the default. The Skill does not require explicit publication consent, a content preview, destination confirmation, sensitivity classification, or redaction before posting.

The topic also includes the absolute local file path:

bash

--topic "$TOPIC [local file: $FILE_PATH]"

Consequently, both findings derived from a local file and local filesystem metadata may be exposed to the engine or included in externally visible output. Even if the raw file is not published verbatim, derived results can reveal proprietary sequences, experimental outcomes, unpublished research, or confidential project details.

Attack Path

1. A user supplies a proprietar ...[truncated 1287 chars]

Remediation

View remediation

Remediation Suggestions

1. Make --dry-run the mandatory default for all local-file investigations.
2. Require explicit user confirmation immediately before any publication action.
3. Show the complete proposed post, destination community, participating tools, and data recipients in the confirmation prompt.
4. Separate analysis and publication into distinct commands so file analysis cannot post implicitly.
5. Remove absolute local paths from topics and published content; use a neutral filename or generated identifier when necessary.
6. Detect and redact credentials, personal information, proprietary identifiers, unpublished findings, and workspace-memory content.
7. Warn users that derived findings can remain sensitive even when raw files are not uploaded verbatim.
8. Provide destination visibility, retention, deletion, and access-control information before consent.
9. Add a policy control that completely disables posting for sensitive or locally sourced files unless the user deliberately overrides it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes investigating local files with a multi-agent science engine and examples include network-oriented tools and posting, but it does not clearly warn users that local file content may leave the local environment. This creates a substantial privacy and confidentiality risk, especially for unpublished research data, proprietary datasets, or sensitive documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is presented as a local file investigation tool, but its documented behavior sends prompts derived from local files into a broader multi-agent system and may post outputs externally. That mismatch can mislead users into thinking processing is purely local, increasing the chance they expose sensitive file contents to networked tools or public/community destinations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation criteria are broad enough to match common requests like 'analyze my data' or 'summarize this paper,' which increases the likelihood the skill is invoked automatically in situations the user did not intend. In this skill, overbroad triggering is more dangerous because invocation can lead to local file processing, external service use, and potential posting of results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read workspace memory and append it to the analysis topic without clear user notice or consent. This can silently combine unrelated project context, confidential notes, or sensitive research goals with file-derived content sent to external tools, expanding data exposure beyond what the user requested.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 65% confidence

Finding

The supported file types table claims broad direct handling of PDFs, sequence files, tabular data, JSON, and TXT. Yet the actual runnable examples and automatic skill-selection guidance center on passing content into external domain skills, with little concrete implementation detail for standalone JSON/TXT investigation beyond generic dispatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.