ClawHub
Back to skill

Security audit

PaperRead-Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed two-pass PDF review prompt with no code execution, persistence, credential use, or data export behavior.

Install only if you want this specific workflow: it will analyze uploaded CVPR PDFs in two passes and produce the final critique in Chinese by default. The publisher should normalize file encodings to plain UTF-8 without BOM for cleaner review, but no harmful behavior was found.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: cvpr-pdf-two-pass-review
description: Analyze uploaded CVPR paper PDFs with a strict two-pass workflow. First pass extracts verifiable facts with page/section/figure/table evidence only. Second pass produces a 2000-3000 Chinese research critique grounded in those facts. Use when the user uploads a paper PDF and asks for deep interpretation, critical review, reproducibility assessment, or PhD-level reading notes.
---
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
4. Enforce evidence tags for core claims: `[Evidence: p.X, Sec.Y, Fig/Table Z]`.
5. If any required information is missing, explicitly state `Not provided in paper` or `Insufficient evidence`.

## Output Rules

- Keep analysis strictly based on uploaded PDF content.
- Do not introduce external papers, benchmarks, or assumptions unless user explicitly asks.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Hidden Instructions

High
Category
Prompt Injection
Content
You are doing FACT EXTRACTION ONLY.
Do not evaluate quality, do not conclude impact, and do not use external knowledge.
Use only the uploaded PDF.
Confidence
90% confidence
Finding
The file begins with a hidden Unicode character (BOM/zero-width character), which can be used to conceal or subtly alter instructions in prompt-based skills. In this case the visible content also contains instruction-shaping language such as 'FACT EXTRACTION ONLY' and 'Do not evaluate', which could suppress downstream security reasoning if this file is reused in a broader agent workflow.

Hidden Instructions

High
Category
Prompt Injection
Content
Now produce a deep research critique based on the fact sheet you just extracted.
Constraint: use only the fact sheet plus PDF evidence. No external sources or guesses.
If uncertain, explicitly write `Insufficient evidence`.
Confidence
94% confidence
Finding
The file begins with a hidden Unicode character/BOM before the visible instruction text, which can be used to conceal prompt content or cause inconsistent parsing across tools. In an agent skill, hidden or non-printing characters increase the risk that reviewers, scanners, and runtime components interpret the prompt differently, making instruction smuggling or policy bypass harder to detect.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
The skill metadata explicitly requires a Chinese critique in pass 2 regardless of the user's stated language preference. This can override user intent and create an unwanted behavior constraint, which is a prompt-safety and UX issue even though it is not directly a code-execution risk. In context, the constraint is visible and domain-specific rather than covertly malicious, so the danger is limited.

Ae2

Medium
Category
analysis-evasion
Confidence
90% confidence
Finding
Artifact content does not match its filename extension

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
Lines L05-L06 explicitly require the response to be in Chinese and constrain the length in Chinese words. This is a natural-language locale policy concern because it forces a specific language without any opt-in, fallback, or explanation that the skill is region-specific.

Static analysis

No suspicious patterns detected.