Mba Thesis Workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 2.1.2-beta.1

Overview

This thesis workflow is mostly coherent, but it uses overly broad local credentials, silent package installation, and unsafe state-file paths that users should review before installing.

Install only after reviewing or patching the credential handling, disabling silent dependency installation, and restricting paper names to safe identifiers. Use an isolated Python/OpenClaw environment, and avoid putting confidential thesis drafts or company details into this workflow unless you accept that prompts and searches may go to external providers.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/research_tools.py:116

Finding

Cross-Agent Session Enumeration and Direct Provider Credential Access

Content

View full analysis

= 2 else "unknown" ``` ```python plugins_base = Path.home() / ".openclaw" / "agents" / agent_id / "agent" / "plugins" catalog_path = None for subdir in plugins_base.iterdir(): if not subdir.is_dir(): continue candidate = subdir / "catalog.json" if candidate.exists(): try: with open(candidate) as f: catalog = json.load(f) providers = catalog.get("providers", {}) if provider in providers or "minimax-cn" in providers: catalog_path = candidate break except Exception: continue with open(catalog_path) as f: catalog = json.load(f) providers = catalog.get("providers", {}) cfg = providers.get(provider) or providers.get("minimax-cn", {}) return { "base_url": cfg["baseUrl"], "api_key": cfg["apiKey"], "api_type": cfg.get("api", "anthropic-messages"), } ``` ```python req = urllib.request.Request( f"{base_url}/v1/messages", data=data, headers={ "Content-Type": "application/json", "x-api-key": api_key, "anthropic-version": "2023-06-01", }, method="POST" ) with urllib.request.urlopen(req, timeout=120) as resp: result = json.loads(resp.read()) ``` ```python re ...[truncated 2820 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/research_tools.py:39

Finding

Legacy Credential Retrieval Reads Shell Configuration and Executes Login-Shell Initialization

Content

View full analysis

str: try: result = subprocess.run( ['bash', '-lc', 'printf "%s" "$MINIMAX_API_KEY"'], capture_output=True, text=True, timeout=5 ) key = result.stdout.strip() if key and len(key) > 10: return key except Exception: pass try: zshrc_path = os.path.expanduser('~/.zshrc') with open(zshrc_path, 'r', encoding='utf-8') as f: for line in f: if line.strip().startswith('export MINIMAX_API_KEY='): val = line.strip().split('=', 1)[1].strip() if val.startswith('"') and val.endswith('"'): return val[1:-1] elif val.startswith("'") and val.endswith("'"): return val[1:-1] except Exception: pass return '' ``` ### Technical Analysis The compatibility function attempts to obtain a provider secret by starting a Bash login shell and then directly parsing the user's `~/.zshrc`. A login shell can execute user-controlled shell startup files, while direct parsing gives the Skill access to a long-lived API credential stored outside the project workspace. The function is documented as deprecated, and no active call site was identified during the audit. Therefore, there is no evidence that it currently transmits the recovered key. Nevertheless, shipping an unused credential-retrieval primitive creates unnecessary capability and expands the consequences of a future call-site change or indirect invocation. The approach also assumes a fragile shell-file format and may return stale, malformed, or unintended values. ### Attack Path 1. A future code path, imported ext ...[truncated 1304 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/run_workflow.py:268

Finding

Normal Workflow Startup Silently Installs an Unpinned Optional Package

Content

View full analysis

=0.5.0"], capture_output=True, text=True, timeout=120 ) if r.returncode != 0: raise RuntimeError(r.stderr or "pip install failed") ``` ```python Dependency( "mineru-open-api", _check_mineru, install_cmd="pip install mineru-open-api>=0.5.0", install_fn=_install_mineru, required=False, block_on_fail=False, description="docx parsing enhancement", install_category="silent" ), ``` ```python installable_silent = [ d for d in deps if d.status == DepStatus.INSTALLABLE and d.install_category == "silent" ] if installable_silent and not skip_install: print(f"Attempting to install {len(installable_silent)} dependencies") for dep in installable_silent: dep.try_install() ``` The normal launcher calls preflight without disabling installation: ```python can_proceed, deps, needs_ai_deps = preflight_check() ``` ### Technical Analysis The workflow's normal preflight process automatically installs `mineru-open-api` when the import check fails. The dependency is optional, but installation proceeds without explicit user approval because it is categorized as `silent`. The version requirement uses only a lower bound, `>=0.5.0`. This allows any future matching release to be downloaded and installed after the Skill itself has been reviewed. Python package installation may execute build-system code and installs executable modules that will later run inside the workflow. Although the package is retrieved through `pip` rather than an explicit unknown URL, silent installation of an open-ended package makes the Skill's effective codebase mutable and non-reproducib ...[truncated 1289 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/state_manager_v2.py:74

Finding

Unvalidated Paper Name Allows Workspace Path Traversal and State-File Modification

Content

View full analysis

str: paper_dir = os.path.join(WORKSPACE, paper_name) os.makedirs(paper_dir, exist_ok=True) return paper_dir def _get_state_path(paper_name: str) -> str: return os.path.join(_get_paper_dir(paper_name), "_outline_state.json") ``` ```python def outline_save(paper_name: str, outline: Dict[str, Any]) -> Dict[str, Any]: state_path = _get_state_path(paper_name) state = { "paper_name": paper_name, "outline": outline, "writing_progress": { "current_node_id": None, "completed_node_ids": [], "failed_node_ids": [], "retry_count": {} }, "updated_at": datetime.now().isoformat() } tmp_path = state_path + ".tmp" with open(tmp_path, 'w', encoding='utf-8') as f: json.dump(state, f, ensure_ascii=False, indent=2) os.replace(tmp_path, state_path) return {"ok": True, "path": state_path} ``` ```python def outline_delete(paper_name: str) -> Dict[str, Any]: state_path = _get_state_path(paper_name) if os.path.exists(state_path): os.remove(state_path) return {"ok": True} return {"ok": False, "error": "State file does not exist"} ``` ```python def _get_orchestrate_state_path(paper_name: str) -> str: return os.path.join(_get_paper_dir(paper_name), "_orchestrate_state.json") def save_orchestrate_state(paper_name: str, state: Dict[str, Any]) -> bool: path = _get_orchestrate_state_path(paper_name) try: state["last_updated"] = datetime.now().strftime("%Y-%m-%dT%H:%M:%S+08:00") tmp_path = path + ".tmp" with open(tmp_path, 'w', encoding='utf-8') as f: json.dump(state, f, ensure_ascii= ...[truncated 3247 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (144)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The metadata advertises end-to-end Word/DOCX export and formatting guarantees, but the body delegates critical export and formatting responsibilities to a separate thesis-docx-export skill and auxiliary scripts. This can mislead users about what component is responsible for document transformation, data handling, and formatting safeguards, weakening trust boundaries and reviewability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The public action contract says phase3_export confirms and exports Word, but the router silently sends that action into Phase 3.5 deep review instead. In an agent skill, action-schema deception can cause unsafe orchestration, broken human approval assumptions, and incorrect downstream automation decisions because callers believe an export occurred when it did not.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module reads provider credentials from ~/.openclaw agent plugin catalogs and builds direct outbound LLM clients, giving the skill access to secrets and network capabilities beyond what a thesis-research helper should require. In skill context, this is more dangerous because the feature silently bypasses normal agent mediation and could expose local API keys or make unauthorized external requests under the user's identity.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/reviewer.py (reported line 115)May include surrounding context.

python

if word_count_range:
        prompt += f"\n\n### 字数参考范围\n目标字数：{word_count_range[0]} - {word_count_range[1]} 字"

    return prompt


# ============================================================

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is a real integrity/destructive-state bug: reset_orchestrate_state() is documented as resetting only orchestrate state, but it deletes the outline state file via _get_state_path(). In this thesis workflow, the outline is the authoritative structure for chapters/nodes, so a caller expecting a safe orchestrator reset could accidentally erase the paper outline and cause data loss or inconsistent workflow state.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/tests/REAL_SAMPLES_README.md (reported line 76)May include surrounding context.

ls ~/.openclaw/workspace/v2_real_*

清理（谨慎操作，会删除本地 state）

rm -rf ~/.openclaw/workspace/v2_real_*

text

## 💡 建议

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/tests/REAL_SAMPLES_README.md (reported line 76)May include surrounding context.

ls ~/.openclaw/workspace/v2_real_*

清理（谨慎操作，会删除本地 state）

rm -rf ~/.openclaw/workspace/v2_real_*

text

## 💡 建议

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs sending exception and workflow details through Feishu/WeChat, which are external messaging platforms, without any warning, consent flow, data classification rules, or redaction requirements. Because the notifications may contain thesis chapter names, process state, exception descriptions, and potentially research content, this creates a meaningful risk of sensitive academic or business information being transmitted outside the local workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file is written as operational skill documentation in Chinese from the title onward, and user-facing workflow text later includes Chinese-only prompts and confirmations. Because no opt-in or alternative locale is offered in this file, it may violate a language/locale policy requiring user choice rather than forcing one language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly advertises parallel use of external search providers such as Tavily, arXiv, OpenAlex, and web search, but it does not warn users that thesis content, company names, research topics, or other prompts may be transmitted to third-party services. In a thesis-writing workflow, this can expose sensitive academic work, unpublished ideas, or confidential business case details, making the omission a real privacy and data-handling vulnerability.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: scripts/tests/REAL_SAMPLES_README.md:76