ClawHub
Back to skill

Security audit

Hf Papers

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent HuggingFace paper-report generator, with expected network translation and local report-writing behavior that users should configure carefully.

Install this only if you are comfortable fetching HuggingFace pages and sending paper abstracts to your configured translation provider. Use a trusted HTTPS DeepLX/OpenAI-compatible endpoint, keep API keys in a local `.env`, prefer `--no-translate` for no third-party translation, and install dependencies in a virtual environment with pinned versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:65
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Place dependencies in a committed requirements or lock file with cryptographic hashes: ```text python-dotenv== \ --hash=sha256: ``` 3. Require hash verification during installation: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate and review the lock file in a controlled environment. Include all transitive dependencies and their hashes if additional dependencies are introduced. 5. Prefer an isolated virtual environment rather than modifying the Agent's global Python installation: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 6. Configure a trusted package index explicitly where appropriate, and avoid untrusted mirrors or permissive extra-index configurations. 7. Update every installation example in `SKILL.md` and `README.md` so users and Agents are not directed to bypass the pinned, hash-verified installation process. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (32)

Tainted flow: 'req' from os.environ.get (line 99, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_report.py (reported line 72)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=DEEPLX_TIMEOUT) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            if result.get("code") == 200:
                return result.get("data", "").strip()

Tainted flow: 'req' from os.environ.get (line 99, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_report.py (reported line 111)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=OPENAI_TIMEOUT) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            content = result.get("choices", [{}])[0].get("message", {}).get("content", "").strip()
            if content:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

bash
git clone https://github.com/isongxw/hf-paper-skill.git
cd hf-paper-skill
cp .env.example .env
# 编辑 .env 填入翻译 token
pip3 install python-dotenv
python3 scripts/generate_report.py --period weekly

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior promises translation, fallback logic, bilingual output, trend analysis, and a specific save workflow, while the analyzed implementation apparently does not provide those guarantees and supports undeclared behavior such as JSON output. This mismatch can mislead users about what data is transmitted, what processing occurs, and where files are written, undermining informed consent and safe review of the skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 136)May include surrounding context.

md
# DeepLX / OpenAI LLM 翻译配置 - 从环境变量读取，禁止硬编码 token
# 设置方式（优先级从高到低）：
#   1. export 环境变量（任意框架通用）
#   2. 在 skill 目录下创建 .env 文件（任意框架通用）
#   3. 在 agent 的默认 env 文件中配置（如 ~/.hermes/.env）
import os
from dotenv import load_dotenv

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
# DeepLX / OpenAI LLM 翻译配置 - 从环境变量读取，禁止硬编码 token
# 设置方式（优先级从高到低）：
#   1. export 环境变量（任意框架通用）
#   2. 在 skill 目录下创建 .env 文件（任意框架通用）
#   3. 在 agent 的默认 env 文件中配置（如 ~/.hermes/.env）
import os
from dotenv import load_dotenv

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
# DeepLX / OpenAI LLM 翻译配置 - 从环境变量读取，禁止硬编码 token
# 设置方式（优先级从高到低）：
#   1. export 环境变量（任意框架通用）
#   2. 在 skill 目录下创建 .env 文件（任意框架通用）
#   3. 在 agent 的默认 env 文件中配置（如 ~/.hermes/.env）
import os
from dotenv import load_dotenv

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_report.py (reported line 26)May include surrounding context.

python
# DeepLX / OpenAI LLM 翻译配置 - 从环境变量读取，禁止硬编码 token
# 设置方式（优先级从高到低）：
#   1. export 环境变量（任意框架通用）
#   2. 在 skill 目录下创建 .env 文件（任意框架通用）
#   3. 在 agent 的默认 env 文件中配置（如 ~/.hermes/.env）
import os
from dotenv import load_dotenv

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_report.py (reported line 32)May include surrounding context.

python
from dotenv import load_dotenv

# 优先加载本地 .env（与脚本同目录或 skill 根目录）
_local_env = os.path.join(os.path.dirname(__file__), '..', '.env')
load_dotenv(_local_env)

# --- DeepLX 配置 ---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README documents translation backends but does not clearly warn that full paper abstracts are sent to external API providers for translation. Since the skill explicitly requires preserving complete abstracts, users and agent operators may unknowingly transmit third-party content or sensitive prompts to remote services, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

DeepLX（默认）：

env
TRANSLATE_BACKEND="deeplx"
DEEPLX_URL="https://api.deeplx.org/你的token/translate"

OpenAI 兼容 LLM（OpenAI、硅基流动、DeepSeek 等）：

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

md
| 服务商 | BASE_URL | 推荐模型 |
|--------|----------|----------|
| OpenAI | `https://api.openai.com/v1` | `gpt-4o-mini` |
| 硅基流动 | `https://api.siliconflow.cn/v1` | `Qwen/Qwen2.5-7B-Instruct` |
| DeepSeek | `https://api.deepseek.com/v1` | `deepseek-chat` |
| 通义千问 | `https://dashscope.aliyuncs.com/compatible-mode/v1` | `qwen-turbo` |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

md
|--------|----------|----------|
| OpenAI | `https://api.openai.com/v1` | `gpt-4o-mini` |
| 硅基流动 | `https://api.siliconflow.cn/v1` | `Qwen/Qwen2.5-7B-Instruct` |
| DeepSeek | `https://api.deepseek.com/v1` | `deepseek-chat` |
| 通义千问 | `https://dashscope.aliyuncs.com/compatible-mode/v1` | `qwen-turbo` |

## Agent 集成

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README suggests broad natural-language triggers such as asking for 'recent热门论文' or '有什么新论文', which can cause the agent to invoke this skill in contexts the user may not expect. Because the skill fetches external content, optionally transmits abstracts to third-party translation APIs, and writes local files, overbroad invocation increases the chance of unintended network/data actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill clearly requires environment variables, network access to HuggingFace and translation APIs, and writes Markdown reports locally, yet it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: the runtime may grant broader capabilities than users or reviewers expect, increasing the chance of unintended data egress or file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill defaults to sending paper abstracts to third-party translation services but does not prominently warn users at the behavioral description level that content will be transmitted externally. Even if abstracts are public, user prompts, selected papers, or derived report content may still reveal interests or sensitive research topics, creating a privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill is designed to send content to external endpoints, including OpenAI-compatible APIs, which creates a real data egress surface. While external transmission is expected for this functionality, it becomes a vulnerability when not tightly scoped, disclosed, and consented to, especially if prompts or report content contain sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
required_environment_variables:
  - DEEPLX_URL — DeepLX 翻译 API 端点（使用 DeepLX 后端时必需）
  - OPENAI_API_KEY — OpenAI 兼容 API 密钥（使用 OpenAI 后端时必需）
  - OPENAI_BASE_URL — OpenAI 兼容 API 地址（可选，默认 https://api.openai.com/v1）
  - OPENAI_MODEL — 翻译用模型名（可选，默认 gpt-4o-mini）
  - TRANSLATE_BACKEND — 翻译后端选择（可选，默认 deeplx）
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation guidance says to use the skill for generic requests like "最近有什么热门论文？", "有什么 AI 论文推荐？", and "介绍一下最近的 AI 研究趋势" without narrowing the source to HuggingFace or distinguishing when this skill should not be used. These broad examples could cause unintended invocation for general research questions that are not specifically about this skill's HuggingFace papers workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The DeepLX endpoint represents another external transmission channel for abstracts and related text. Because the endpoint is configurable, a user or deployer could inadvertently point the skill at an untrusted service, increasing the risk of data leakage or interception.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

env
TRANSLATE_BACKEND="deeplx"
DEEPLX_URL="https://api.deeplx.org/你的token/translate"

方式二：OpenAI 兼容 LLM

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Use of an OpenAI-compatible API involves transmitting text outside the local environment, and the base URL is configurable, which can redirect content to arbitrary third-party services. Without strict controls and disclosure, this creates a meaningful confidentiality and governance risk.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

env
TRANSLATE_BACKEND="openai"
OPENAI_BASE_URL="https://api.openai.com/v1"
OPENAI_API_KEY="sk-your-key-here"
OPENAI_MODEL="gpt-4o-mini"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Defaulting to Chinese translation means external processing can occur automatically without an activation-time opt-in, which weakens user consent and increases inadvertent data transmission. In this skill the source material is usually public paper abstracts, so the security impact is limited, but the consent and privacy model is still weak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire document is written in Chinese and includes hard-coded Chinese output strings such as "昨日热门论文" and a title replacement from "今日" to "昨日". There is no indication that the skill is region-specific or that users may opt into another language, which makes this a natural-language locale policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest does mention DeepLX and OpenAI-compatible translation backends, so translation-related networking is expected. However, this file additionally loads credentials from local .env files and supports a fully configurable OPENAI_BASE_URL, enabling transmission of paper abstracts to arbitrary third-party endpoints; that capability is broader than a straightforward report generator and is not clearly framed as part of the user-facing purpose in this file's own behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
# --- OpenAI LLM 配置（备选翻译后端） ---
TRANSLATE_BACKEND = os.environ.get("TRANSLATE_BACKEND", "deeplx")  # deeplx / openai
OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "")
OPENAI_MODEL = os.environ.get("OPENAI_MODEL", "gpt-4o-mini")
OPENAI_TIMEOUT = 30

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

md
# --- OpenAI LLM 配置（备选翻译后端） ---
TRANSLATE_BACKEND = os.environ.get("TRANSLATE_BACKEND", "deeplx")  # deeplx / openai
OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "")
OPENAI_MODEL = os.environ.get("OPENAI_MODEL", "gpt-4o-mini")
OPENAI_TIMEOUT = 30

Static analysis

No suspicious patterns detected.