Mba Thesis Workflow

• Outcome: Review
• Latest audit: Jul 9, 2026 · 6:26 AM UTC
• Version: 2.1.2-beta.1

Overview

This thesis workflow is mostly purpose-aligned, but it reaches into local OpenClaw session credentials, can auto-install dependencies, and may send thesis documents or topics to external services without clear user-facing consent.

Install only if you are comfortable with a beta thesis workflow that can modify its Python environment, use external search and document-parsing services, read OpenClaw session/provider configuration, and store local workflow/config files. Avoid it for confidential, embargoed, or company-sensitive thesis material unless you review and disable the MinerU/cloud parsing and credential-discovery paths first.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# ── 1. MinerU 解析 docx 为 Markdown ─────────────────────
    try:
        result = _sub.run(
            ["mineru-open-api", "flash-extract", docx_path],
            capture_output=True, text=True, timeout=30
        )

• Confidence: 86% confidence
• Finding: This subprocess call executes an external program on a user-influenced file path as part of document export. Although shell injection is mitigated by passing an argument list, invoking a third-party parser on untrusted DOCX content expands the attack surface: a malicious or trojaned `mineru-open-api` binary in PATH, or vulnerabilities inside the external parser, could lead to unexpected code execution or local compromise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--limit", str(max_results),
            "--json",
        ]
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=TOOPENALEX
        )
        if result.returncode != 0:

• Confidence: 82% confidence
• Finding: This subprocess executes a Python script resolved from a sibling skill path, with a fallback to a user-writable workspace location. If that sibling script is replaced or tampered with, invoking this thesis skill will execute attacker-controlled code in the local environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_tavily_mcp():
    r = subprocess.run(
        ["mcp", "install", "tavily-mcp"],
        capture_output=True, text=True, timeout=60
    )

• Confidence: 96% confidence
• Finding: The script can automatically install an MCP dependency by executing `mcp install tavily-mcp` during pre-flight checks, which changes the local environment and pulls code/configuration from an external source. Even without shell injection, this is risky in an agent skill because routine document-processing should not silently install new components that may have broad runtime permissions or introduce supply-chain risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_mineru():
    r = subprocess.run(
        [sys.executable, "-m", "pip", "install", "mineru-open-api>=0.5.0"],
        capture_output=True, text=True, timeout=120
    )

• Confidence: 98% confidence
• Finding: The script automatically runs `pip install mineru-open-api>=0.5.0`, which modifies the Python environment and retrieves code from a package repository at runtime. In a skill context, this creates a supply-chain and local-environment modification risk, especially because the install is triggered from a thesis workflow rather than an explicit admin/setup path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_skill(name: str):
    openclaw_path = _find_openclaw()
    r = subprocess.run(
        [openclaw_path, "skills", "install", name],
        capture_output=True, text=True, timeout=60
    )

• Confidence: 93% confidence
• Finding: The code can install additional OpenClaw skills via `openclaw skills install name`, effectively extending agent capabilities at runtime. Installing plugins/skills from within a document workflow broadens the attack surface and may grant access to new tools or data flows not expected by the user.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_python_pkg(cmd: list):
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if r.returncode != 0:
        raise RuntimeError(r.stderr or "pip install failed")

• Confidence: 95% confidence
• Finding: `_install_python_pkg(cmd)` is a generic wrapper around `subprocess.run(cmd, ...)` for package installation, enabling environment changes through commands supplied by code paths elsewhere in the script. While current call sites appear controlled, this helper normalizes runtime package installation as part of the workflow and increases the risk of unintended dependency execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises substantial capabilities including shell execution, file read/write, environment access, and network search, yet declares no permissions boundary. This creates a trust and review gap: an operator may install or invoke it expecting a documentation-only workflow while it can access local workspace state, spawn subprocesses, and reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose is thesis authoring/export, but the documentation indicates materially broader behavior: dependency installation, release/publishing, gatekeeper/daemon behavior, session and plugin inspection, and external multi-provider search. That mismatch can conceal sensitive operations such as credential discovery, package installation, or background orchestration from users and reviewers, increasing the chance of overbroad execution in a high-trust writing workflow.

Intent-Code Divergence

High

• Confidence: 91% confidence
• Finding: The document warns that Phase 1 must not call the Python API directly because doing so bypasses HIL controls and state-machine protections, then immediately provides direct Phase 1 API examples. Contradictory guidance in a security-sensitive workflow increases the likelihood that agents or operators will bypass required approval checkpoints, audit logging, and lock enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer collects USER_EMAIL and SENDER_EMAIL and persists them in a local config file, enabling outbound delivery of thesis outputs. That capability is not disclosed in the skill metadata, so users may provide personal contact data without understanding the feature or its privacy implications.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: For a thesis authoring/export skill, configuring an outbound sender account is a broader capability than local document generation and could be abused to transmit generated documents or user data externally. Even if intended for convenience, the hidden expansion from authoring to email delivery increases the attack surface and user risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This prompt-construction module silently performs external retrieval via `multi_search_text` based on node metadata, even though its primary role appears to be local context assembly. That creates an unexpected data-flow boundary: user- or document-derived keywords can trigger undeclared outbound queries, potentially leaking thesis topics or sensitive research subjects to external services and introducing untrusted content directly into prompts.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Automatically invoking network-style search from a context builder expands the component's authority beyond its stated purpose and violates least surprise/least privilege. In an academic-thesis skill, this is more dangerous because thesis titles, chapter subjects, and research keywords may contain confidential company, unpublished, or personally identifying information that should not be sent to external systems by default.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The export script automatically invokes an external CLI for optional verification, which means normal document generation can trigger additional local program execution. In a thesis-writing skill, users may reasonably expect file conversion, but not hidden secondary processing by another tool; this increases risk when handling untrusted environments, PATH hijacking, or vulnerable document-analysis tooling.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The code explicitly routes thesis DOCX files through the MinerU Open API path, and the inline comment acknowledges cloud upload privacy risk. In a thesis-writing skill, documents may contain unpublished research, student identity, company case data, or confidential proposal material, so undisclosed third-party transfer is a significant data-exposure vulnerability.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code enumerates active OpenClaw sessions, locates local agent plugin catalogs, extracts provider API keys and base URLs, and builds direct outbound LLM clients. For a thesis-writing skill, this is a context-inappropriate capability expansion that grants access to credentials and network actions beyond the stated purpose, increasing the risk of unauthorized secret use and data exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The fallback routine reads ~/.zshrc to recover MINIMAX_API_KEY, which is unrelated to normal thesis workflow behavior and accesses a sensitive local configuration source. Even if intended for reliability, harvesting secrets from shell startup files broadens access to credentials without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The CLI auto-installs Python packages and MCP dependencies during execution, which is a clear local-environment modification behavior unrelated to the core act of writing/exporting a thesis. In an agent skill, this is dangerous because users may invoke the tool expecting content generation, not software installation with external network fetches.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: This is a real integrity and availability issue: the function named and documented as resetting only orchestrate state actually deletes the outline state file via _get_state_path(). In a thesis workflow, that can silently destroy the authoritative outline/workflow state for a paper, causing data loss, workflow corruption, and potentially resetting user progress in ways callers do not expect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises parallel use of external search services (Tavily, arXiv, OpenAlex, web search) and explicitly mentions collecting real company names, but it does not disclose that user-supplied thesis topics, company identifiers, or draft content may be transmitted to third-party services. In an academic/thesis workflow, those inputs can contain unpublished research plans, proprietary company information, or personal data, so lack of notice and controls creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script writes personal email configuration to config.env in plaintext without warning about local storage, file permissions, backups, or multi-user system exposure. Plaintext persistence of contact/configuration data makes accidental disclosure more likely and may facilitate later misuse if other components read the file.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly instructs the agent to perform file writes, command execution, and automated repair loops, but it does not pair those capabilities with clear user-facing consent, scope limits, or risk warnings. In a thesis-writing skill that may handle local workspace files and generate deliverables automatically, this increases the chance of unintended file modification, repeated command execution, or silent changes to academic content without the user fully understanding what the agent will do.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script runs an external CLI without an upfront warning or explicit consent, which is a security-relevant transparency problem. In an academic document workflow, this is somewhat more concerning because users may process sensitive thesis material and may not expect that export triggers another local tool that can read document contents.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: User queries are forwarded to an external search provider through mcporter without any user-facing notice or consent mechanism. In a thesis workflow, prompts may contain unpublished research topics, personal data, or confidential institutional information, so silent transmission creates a meaningful privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends raw user queries to arXiv/OpenAlex-related tooling without explicit warning. Because this skill is used for academic writing, users may submit sensitive thesis themes, proprietary business case details, or embargoed research ideas that should not be shared externally by default.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: scripts/tests/REAL_SAMPLES_README.md:76