ClawHub
Back to skill

Security audit

Arxiv Search

Security checks for vulnerabilities and agentic risk

Overview

This looks like an arXiv search CLI, but it needs review because it tells users to run mutable remote code and ships unrelated verification code that can execute Python files.

Install only after reviewing the exact Python file you will run. Prefer the bundled artifact or a pinned, checksummed release instead of the curl-from-main instruction, avoid running the CI verifier on untrusted folders outside a sandbox, and treat search terms as potentially observable until the API endpoint uses HTTPS.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:34
Finding

Mutable Remote Python Payload Is Downloaded for Later Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
arxiv_search.py:17
Finding

arXiv Search Queries and API Responses Use Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
ci/verify_product.py:37
Finding

Product Verification Harness Executes Untrusted Python Files with Ambient Privileges

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The reported behavior includes filesystem inspection, subprocess execution, compilation checks, source scanning, documentation validation, and invoking another CI script, all under the branding of an arXiv search tool. That combination is especially risky because it masks broad code-execution and repository-enumeration capabilities behind an innocuous research-use description, which could enable unauthorized local discovery or execution in an agent environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The reported behavior includes filesystem inspection, subprocess execution, compilation checks, source scanning, documentation validation, and invoking another CI script, all under the branding of an arXiv search tool. That combination is especially risky because it masks broad code-execution and repository-enumeration capabilities behind an innocuous research-use description, which could enable unauthorized local discovery or execution in an agent environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The reported behavior includes filesystem inspection, subprocess execution, compilation checks, source scanning, documentation validation, and invoking another CI script, all under the branding of an arXiv search tool. That combination is especially risky because it masks broad code-execution and repository-enumeration capabilities behind an innocuous research-use description, which could enable unauthorized local discovery or execution in an agent environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill advertises executable functionality and the analyzer detected file read, network, and shell capabilities, but the manifest declares no explicit tool scope or permissions. In an agent setting, this creates unnecessary ambiguity about what the skill may access and increases the chance that a reviewer or runtime grants broader privileges than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes an arXiv skill that supports full-text download and citation export. In this file, the implemented commands only query arXiv metadata, print URLs, and display abstracts; there is no code to download paper PDFs/full text or export citations in any format.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This function executes every Python file in the target folder with a self-test argument to determine whether a self-test exists. In a CI or verification context, that means untrusted repository code is run during validation, enabling arbitrary code execution from a malicious skill or product under review.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python
all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

This logic executes any test_*.py or *_test.py file found in the target folder. In the context of verifying third-party skills, that allows a malicious contributor to place arbitrary code in a test file and have CI run it automatically, leading to arbitrary code execution and possible secret exfiltration or environment compromise.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python
# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The top-level documentation identifies the tool as "arxiv_tools.py" and gives usage examples under that name, while the actual file under analysis is arxiv_search.py. This does not change runtime behavior, but it is a documentation contradiction that can mislead users about what artifact they are invoking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.