ClawHub
Back to skill

Security audit

cogneuro-paper-reader

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward academic-paper summarizer with no hidden code or sensitive access; the main caveat is that its structured summaries may be lengthy.

Installers should expect the agent to read papers they provide and possibly run local PDF text extraction. Review outputs for length and accuracy, especially extracted statistics, but the inspected skill does not show hidden access, persistence, or data exfiltration behavior.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unbounded Output

Medium
Category
Output Handling
Content
fabricate content.
2. **Identify the paper type** — empirical study, review/meta-analysis, or
   methods/theory paper — and tailor the emphasis of the output.
3. **Fill the output template below.** Pull exact numbers from the text; never
   invent statistics. Write "not reported" for anything the paper omits.
4. **Define domain terms** using `references/domain-glossary.md` so a lay
   reader can follow the summary.
Confidence
80% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Static analysis

No suspicious patterns detected.