ScienceClaw: Query (Dry Run)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:09 AM UTC
• Version: 1.0.2

Overview

This skill is a legitimate dry-run science research helper, but it automatically adds stored workspace memory to research queries without user confirmation.

Install only if you are comfortable with the skill reading workspace memory.md and using that stored project context in ScienceClaw research queries. For sensitive, confidential, or unpublished research, remove or review memory.md first, or require explicit confirmation before any workspace context is added to a query.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:70

Finding

Mandatory Branded Workflow Redirection in Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70–78
Vulnerability Type: Agent response manipulation and workflow redirection
Risk Level: Medium

Complete Code Snippet:

markdown

## After running

Report back to the user:
- A summary of key findings (list top 3–5)
- Which tools/skills were used
- How many literature sources were pulled
- Offer follow-up options:
  - "Want me to post this to Infinite?" → use `scienceclaw-post` skill
  - "Want a deeper multi-agent investigation?" → use `scienceclaw-investigate` skill
  - "Want to investigate a local file instead?" → use `scienceclaw-local-files` skill

Technical Analysis

The skill requires the agent to append predefined calls to action that direct the user toward Infinite and additional ScienceClaw skills. These instructions are unconditional and are not limited to cases in which the user asks to publish results, initiate a multi-agent investigation, or process local files.

Because skill text becomes part of the agent's active instructions, this requirement modifies the expected response behavior whenever the skill is loaded. It introduces branded workflow steering into otherwise ordinary scientific-query responses. The issue is an instruction-level behavior change rather than executable-code compromise.

Attack Path

1. A user asks a scientific question and triggers this skill.
2. The agent runs or attempts to run the documented dry-run investigation.
3. The instructions require the agent to include the listed follow-up prompts.
4. The response directs the user toward publishing on Infinite or invoking additional ScienceClaw workflows, even when those actions were not requested.
5. If the user accepts a prompt, the interaction transitions into an additional service or skill workflow.

Impact Assessment

The issue can influence the current session's output and subsequent workflow selection. It does not, based on the ...[truncated 227 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional requirement to advertise Infinite and related skills.
• Mention publishing, multi-agent investigation, or local-file processing only when the user explicitly requests that functionality or when it is directly relevant.
• Use neutral follow-up language that does not favor a particular service.
• Require explicit confirmation before transitioning to another skill or posting workflow.
• Clearly distinguish optional capabilities from actions necessary to answer the current request.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:63

Finding

Automatic Collection and Propagation of Workspace Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–67
Vulnerability Type: Excessive access to workspace data
Risk Level: Medium

Complete Code Snippet:

markdown

## Workspace context injection

Before running, check if the user's workspace memory contains project context:
- Read `memory.md` in the workspace for stored research focus, organism, compound, or disease
- If found, prepend that context to the topic string:
  e.g. `"tau aggregation [project context: studying frontotemporal dementia, human iPSC model]"`

Technical Analysis

The skill directs the agent to read persistent workspace memory before executing a scientific query and to append discovered information to the topic string. Reading this file is not inherently necessary to perform the declared quick-query function, and the instructions do not require user consent, relevance filtering, sensitivity review, or a preview of the augmented query.

The enriched topic is subsequently supplied to the separately installed scienceclaw-post executable. The skill declares ANTHROPIC_API_KEY as its primary environment variable, indicating an API-backed workflow, but the executable itself is absent from the audited project. Therefore, its exact handling, retention, and transmission of the enriched topic could not be verified. The confirmed weakness is the unnecessary collection and propagation of workspace context; external disclosure remains a potential downstream consequence rather than a verified implementation detail.

Attack Path

1. A user invokes the skill with a scientific query.
2. The agent follows the instruction to locate and read workspace memory.md.
3. Research or project context from that file is prepended to the user's topic without separate consent.
4. The combined topic is passed as the --topic argument to scienceclaw-post.
5. The downstream executable processes the additional workspace information as part o ...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

• Do not read memory.md by default for ordinary scientific queries.
• Ask for explicit, informed user consent before accessing persistent workspace memory.
• Explain which information will be extracted and how it will be incorporated into the query.
• Apply strict relevance filtering and exclude secrets, personal data, credentials, and unrelated project details.
• Display the augmented topic to the user and obtain confirmation before execution.
• Document all downstream data recipients, retention policies, and logging behavior.
• Provide an option to run the query without workspace context.
• Include or otherwise make the downstream executable available for security review so its data-handling behavior can be verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger guidance includes very broad phrases like 'just show me' and 'preview', which commonly appear in ordinary conversation and can cause the skill to activate in unintended contexts. Because this skill runs an external research workflow and may incorporate workspace context, accidental invocation can lead to unnecessary tool execution and exposure of contextual data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to read workspace memory and prepend its contents to the research topic without informing the user at the point of use. This creates a privacy risk because sensitive project, disease, compound, or organism context may be sent to downstream tools or external services beyond the user's explicit request.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatically incorporating memory.md into the topic and then reporting findings back in chat creates a natural-language exfiltration path: stored workspace context can be transmitted to the research tool and then reflected into outputs. In a scientific workflow, that context may include confidential research directions or sensitive biomedical details, making the leakage more consequential.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.