ClawHub
Back to skill

Security audit

il-reader

Security checks for vulnerabilities and agentic risk

Overview

This research assistant needs review because its browser recovery instructions can terminate unrelated browser sessions.

Restrict browser recovery to the ilradar session and remove global cleanup instructions before use. Keep browser profiles separate and protect saved login-state files. Question-bank answers are explicitly supplied without independent verification.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (105)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied chunk performs only a generic HTTP fetch and output truncation. It shows no local question-bank lookup, evidence-gap-driven research, curated resource use, Chrome automation, or answer generation. Although HTTP retrieval could support the declared workflow, this specific target and standalone behavior provide no such connection and materially differ from the stated purpose. This assessment is limited to the supplied chunk.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
**路径约定**：本技能目录记为 `<SKILL>`（`SKILL.md` 所在目录）。命令里请用绝对路径，不要依赖当前工作目录。

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
3. **官网直连** —— 已知端点用 `curl` 直接取字段，见 `references/retrieval.md`

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
题目问"第 n 页""最后一个单词""文件大小""共几页"时，答案就在指定版本的全文字节里。违反以下任一条会直接答错，细节见 `references/retrieval.md`：

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
- `references/retrieval.md` — 证据分流、实测官方端点、**全文与页面核对**三条硬规则

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
站点怎么查，先看档案：`references/sites/<站点>.json` 有入口、控件、已验证步骤与**已记录的障碍**。索引在 `references/search-index.json`，路径覆盖在 `references/exam-scope.md`。

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
- `references/discovered-flows.md` — 已实测发现的可复用检索路径

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
- `references/browser-playwright-cli.md` — playwright-cli 完整命令与浏览器工作流

Global browser cleanup commands contradict the documented isolation from other skills and sessions.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

L005 states that the fixed ilradar session is isolated from other skills and sessions, but L136–L137 provide unscoped close-all and kill-all commands. L178 explicitly recommends kill-all during connection recovery, potentially terminating unrelated browser sessions rather than limiting cleanup to this skill.

Content

No source excerpt is available for this finding.

The recovery workflow instructs global browser termination without warning that unrelated sessions may be affected.

Medium
Category
Output Handling
Confidence
93% confidence
Finding

The recovery step recommends kill-all if the named browser session cannot connect. Unlike the session-scoped close command, this can terminate other CLI-managed browser sessions and lose their in-progress work; the reference's description of clearing residual processes does not disclose that broader impact.

Content

No source excerpt is available for this finding.

The documented workflow replaces the manifest's visible-Chrome evidence collection with direct curl/API retrieval.

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The manifest specifies collecting evidence through visible Chrome controlled by playwright-cli. L49–L55 instead instruct the agent to retrieve HTML with curl, probe discovered endpoints, and use a returning API in place of the browser interaction workflow. This is an explicit alternative to the declared evidence-collection method, rather than merely an expected network request during browser-based research.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/retrieval.md (reported line 53)May include surrounding context.

md
| 来源与需求 | 端点 | 实测情况与适用范围 |
|---|---|---|
| Crossref：已知 DOI 的登记题录 | `GET https://api.crossref.org/works/{doi}` | 单条 JSON 实测 200。核对 `message.DOI` / `title` / `author` / `container-title` / `published-*`；字段缺失时转出版方或全文。**不等于**知网等指定库的统计口径 |
| DOI：解析到登记地址 | `GET https://doi.org/api/handles/{doi}?type=URL%60 或直接 `https://doi.org/{doi}` | 中文 DOI 的 URL 解析实测 200。核对 `responseCode` / `handle` / `values`；返回地址只用于定位，目标记录的实际字段才算证据 |
| PubMed：检索与题录 | `https://eutils.ncbi.nlm.nih.gov/entrez/eutils/` 下的 `esearch.fcgi`、`esummary.fcgi`、`efetch.fcgi` | 端点定位可用，官方指南已停更，限制以当前说明为准。本机 ESearch 网络/TLS 失败，**不要每题盲重试** |
| PubMed：字段与检索翻译 | [PubMed User Guide](https://pubmed.ncbi.nlm.nih.gov/help/) | 按对应段落核对。用 ESearch 时检查 `querytranslation` 与警告；**API 默认顺序不等于网站 Best Match** |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/search-index.json (reported line 247)May include surrounding context.

json
{
      "id": "crossref",
      "name": "Crossref 官方 REST API",
      "url": "https://api.crossref.org/",
      "domains": [
        "api.crossref.org",
        "crossref.org"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 7)May include surrounding context.

json
"status": "blocked",
  "checked_at": "2026-10-09T08:59:44.844Z",
  "entry": {
    "url": "https://api.crossref.org/",
    "final_url": "https://api.crossref.org/swagger-ui/index.html",
    "title": "Swagger UI",
    "status": "empty_or_loading_document",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 8)May include surrounding context.

json
"checked_at": "2026-10-09T08:59:44.844Z",
  "entry": {
    "url": "https://api.crossref.org/",
    "final_url": "https://api.crossref.org/swagger-ui/index.html",
    "title": "Swagger UI",
    "status": "empty_or_loading_document",
    "http_status": 200,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 33)May include surrounding context.

json
"id": "",
      "css": null,
      "role": null,
      "form_action": "https://api.crossref.org/swagger-ui/index.html",
      "locator": null,
      "observed_url": "https://api.crossref.org/swagger-ui/index.html",
      "observed_at": "2026-10-09T08:59:44.032Z"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 35)May include surrounding context.

json
"role": null,
      "form_action": "https://api.crossref.org/swagger-ui/index.html",
      "locator": null,
      "observed_url": "https://api.crossref.org/swagger-ui/index.html",
      "observed_at": "2026-10-09T08:59:44.032Z"
    },
    {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 49)May include surrounding context.

json
"id": "",
      "css": null,
      "role": null,
      "form_action": "https://api.crossref.org/swagger-ui/index.html",
      "locator": {
        "role": "button",
        "name": "Explore",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 55)May include surrounding context.

json
"name": "Explore",
        "exact": true
      },
      "observed_url": "https://api.crossref.org/swagger-ui/index.html",
      "observed_at": "2026-10-09T08:59:44.032Z"
    }
  ],

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 79)May include surrounding context.

json
"使用本题实体或唯一标识查找；在真实结果容器内匹配题名、作者、机构、年份或ID，打开详情读取目标字段。"
      ],
      "transitions": {},
      "entry_url": "https://api.crossref.org/",
      "controls": [
        {
          "tag": "button",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 92)May include surrounding context.

json
"id": "",
          "css": null,
          "role": null,
          "form_action": "https://api.crossref.org/swagger-ui/index.html",
          "locator": {
            "role": "button",
            "name": "Explore",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 98)May include surrounding context.

json
"name": "Explore",
            "exact": true
          },
          "observed_url": "https://api.crossref.org/swagger-ui/index.html",
          "observed_at": "2026-10-09T08:59:44.032Z"
        }
      ],

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 131)May include surrounding context.

json
"id": "crossref-public-doi",
          "kind": "official-api",
          "method": "GET",
          "url_template": "https://api.crossref.org/works/{doi}",
          "response_format": "json",
          "documentation": [
            "https://www.crossref.org/documentation/retrieve-metadata/rest-api/",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sites/crossref.json (reported line 179)May include surrounding context.

json
{
      "kind": "network_error",
      "attempt": 1,
      "detail": "page.goto: Timeout 10000ms exceeded.\nCall log:\n\u001b[2m  - navigating to \"https://api.crossref.org/\", waiting until \"domcontentloaded\"\u001b[22m\n"
    },
    {
      "kind": "empty_or_loading_document",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.json (reported line 645)May include surrounding context.

json
{
      "id": "crossref",
      "name": "Crossref 官方 REST API",
      "url": "https://api.crossref.org/",
      "domains": [
        "api.crossref.org",
        "crossref.org"

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
references/sites/quiz-sysu-library.json:36