ClawHub
Back to skill

Security audit

arxiv-cv-daily

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches and screens arXiv computer-vision papers, saving outputs under a user-chosen directory, with no evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Before installing, expect the skill to contact arXiv, create logs/cache/PDF/text files under the output directory you approve, and require the local pdftotext utility. Choose an output directory you are comfortable writing research artifacts into.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to perform file reads/writes, network access, and shell execution, but it does not declare any explicit tool scope or permission boundaries. That makes the trust boundary unclear and can let the skill run with broader ambient privileges than users expect, increasing the chance of unauthorized filesystem access, command execution, or data exfiltration if the workflow or its inputs are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The prescribed default format includes the label 相关性分数, which imposes a Chinese-language output convention. Elsewhere the file also provides user-facing example messages only in Chinese, and there is no indication that language choice is optional or based on user preference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes fetching arXiv papers, downloading matched PDFs, and summarizing them from full text, but it does not suggest executing local programs or shell-adjacent tooling. Calling subprocess.run on pdftotext gives the skill a broader host-execution capability than is semantically implied by a paper-fetching/summarization skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_arxiv_cs_cv.py (reported line 823)May include surrounding context.

python
command = ["pdftotext", str(pdf_path), str(text_path)]
    try:
        logger.log(f"Extracting text from {pdf_path.name} with pdftotext.")
        completed = subprocess.run(
            command,
            check=False,
            capture_output=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest says the skill will 'download matched PDFs, and summarize the matched papers from full text,' which implies full-text processing for matched papers generally. In code, PDF download, text extraction, and full-text-derived summaries are performed only for papers with match_status == "unclear_needs_pdf_review", while other matched papers keep core_content_draft equal to the abstract rather than a full-text summary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.