ClawHub
Back to skill

Security audit

Arxiv Search

Security checks across malware telemetry and agentic risk

Overview

This is a normal arXiv search CLI, with a bundled CI verifier that should only be run on trusted folders.

Using arxiv_search.py for paper searches is low-risk aside from normal network access to arXiv. Do not run ci/verify_product.py on untrusted directories, because that helper executes Python self-tests and discovered test files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout
Confidence
98% confidence
Finding
r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)
Confidence
91% confidence
Finding
comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence
98% confidence
Finding
st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation declares no permissions, yet the skill clearly instructs downloading and running a Python script from the internet and references network, file-read, and shell-capable behavior. This creates a transparency and trust problem: an agent or user may execute code with broader capabilities than expected, increasing the chance of unintended network access or command execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The documented purpose is limited to arXiv search and citation export, but the analyzed behavior indicates additional functions such as repository verification, compile/self-test, and secret checks via other scripts. This mismatch is dangerous because hidden or under-disclosed behavior can cause an agent to run broader validation or repository-inspection workflows than the operator intended, potentially touching sensitive local files, executing commands, or expanding the attack surface.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The verifier's behavior materially exceeds the stated arXiv-search skill purpose by inspecting and executing local Python files and tests. This mismatch is dangerous because users or automation may trust the skill as a search utility while it actually provides a path to execute repository-controlled code during verification.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
Subprocess execution of local scripts is not justified by the declared arXiv search functionality and creates a direct code-execution primitive. In this context, the mismatch increases suspicion because repository content can influence what gets executed under the guise of verification.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.