ClawHub
Back to skill

Security audit

Research Paper Portal

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent paper-portal purpose, but its scheduled paper-ingestion script can execute shell commands from untrusted paper metadata.

Review before installing. Run the scripts only under a dedicated low-privilege account, do not schedule them until the shell=True LLM invocation is fixed, and use a trusted local or protected ComfyUI endpoint. The website template should also validate paper URLs and render paper fields as text before serving data from external paper sources.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/update-papers.py:92
Finding

Shell Command Injection Through Untrusted Paper Metadata

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/index.html:438
Finding

Stored DOM-Based Cross-Site Scripting and Unsafe Link Injection

Content
View full analysis
${esc(p.chineseTitle || p.title)}
${esc(p.overview || p.excerpt || '')}
${p.source || '学术期刊'}
${cur + 1} / ${papers.length}
`; ``` ### Technical Analysis The portal loads paper records from `paper-index.json` and renders them by assigning a template string to `innerHTML`. The title and overview are partially HTML-escaped, but two fields remain unsafe: - `p.source` is inserted directly into an HTML element without escaping. - `p.url` is inserted directly into a quoted `href` attribute without attribute escaping or URL-scheme validation. An attacker-controlled `source` value can therefore introduce arbitrary HTML, including event-handler payloads. A crafted URL containing quotation marks can break out of the `href` attribute and add HTML attributes. Even without attribute breakout, accepting arbitrary schemes can permit dangerous links such as `javascript:` if a malicious or locally modified paper record reaches the index. The existing `esc` function is not applied to these fields. It also only escapes `&`, `<`, and `>`, so it would not by itself be sufficient for safe interpolation into a quoted HTML attribute. The issue is stored because `daily-publish.py` transfers queued paper objects into `paper-index.json`, after which every visitor loading the affected record processes the payload. ### Attack Path 1. An attacker influences metadata returned by an upstream paper service, compromises the generated queue, or gains the ability to insert a malicious object into `pending-papers.json`. 2. `daily-publish.py` copies t ...[truncated 1248 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

Tainted flow: 'headers' from os.environ.get (line 32, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/update-papers.py (reported line 40)May include surrounding context.

python
from_date = (datetime.now() - timedelta(days=30)).strftime("%Y-%m-%d")
            url = f"{OPENALEX_BASE}/works?search={kw}&filter=from_publication_date:{from_date}&sort=cited_by_count:desc&per_page={max_results}"
            
            resp = requests.get(url, headers=headers, timeout=30)
            data = resp.json()
            
            for work in data.get("results", []):

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This mismatch is security-relevant because the skill text proposes external shell invocation for LLM processing while the description does not clearly disclose that command execution behavior. Hidden or under-disclosed shell execution increases the chance that users approve the skill for content aggregation without realizing it can run commands on the host.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This mismatch is security-relevant because the skill text proposes external shell invocation for LLM processing while the description does not clearly disclose that command execution behavior. Hidden or under-disclosed shell execution increases the chance that users approve the skill for content aggregation without realizing it can run commands on the host.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

  • 详细配置说明
  • API.md - OpenAlex/arXiv API 使用说明
  • COMFYUI.md - ComfyUI Flux2 工作流说明

定时任务配置

使用 OpenClaw cron 或系统 crontab：

bash
# OpenClaw cron
openclaw cron add --name "论文更新" --schedule "0 5 * * *" --script "update-papers.py"
openclaw cron add --name "网站发布" --schedule "0 8 * * *" --script "daily-publish.py"

# 或系统 crontab
0 5 * * * python /path/to/update-papers.py
0 8 * * * python /path/to/daily-publish.py

注意事项

  1. API 限制：OpenAlex 免费无限制，arXiv 建议每 3 秒一次请求
  2. 图片存储：建议每张预览图 <50KB，高清图 <200KB
  3. 论文数量：建议每日发布 3-5 篇，保证质量
  4. 备份：定期备份 paper-index.json 和 pending-papers.json

故障排除

问题解决方案
论文数据为空检查关键词拼写，确认 API 可访问
图片生成失败检查 ComfyUI 服务状态，确认模

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The subprocess call permits tool-parameter abuse because llm_command is concatenated into a shell command and executed with shell=True. If llm_command is ever influenced by configuration, future refactoring, or upstream input, an attacker could replace the intended LLM invocation with arbitrary commands; combined with untrusted prompt content, the execution surface is especially dangerous in this content-ingestion script.

Content

Scanner excerpt · scripts/update-papers.py (reported line 106)May include surrounding context.

python
概述：xxx"""

    try:
        result = subprocess.run(
            f'{llm_command} "{prompt}"',
            shell=True,
            capture_output=True,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill document describes capabilities that involve shell execution, filesystem modification, network access, and scheduled tasks, but it does not declare any explicit tool scope or permissions. That creates a transparency and least-privilege problem: an operator or runtime may allow broader access than users expect, increasing the risk of unintended command execution or server changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Broad trigger phrases can cause unintended activation for generic academic website requests, leading the agent to perform deployment-oriented actions when the user only wanted advice or content. In a skill that can write files, call networks, and configure publishing workflows, accidental invocation materially increases risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs deployment, web server configuration, and scheduled publishing but does not prominently warn that it will modify system state on the user's server. This is dangerous because users may invoke it expecting content help, not realizing it can alter server configuration and establish recurring automated tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document root sets lang="zh-CN", and the UI text throughout the page is Chinese-only, which imposes a specific language/locale on all users. Under the policy criteria, this is a natural-language locale restriction without visible opt-in or explanation that the skill is region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/API.md (reported line 18)May include surrounding context.

python
import requests

url = "https://api.openalex.org/works"
params = {
    "search": "thermoelectric",
    "sort": "cited_by_count:desc",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file's headings and instructional content are all presented in Chinese, and there is no indication that the skill supports other languages or that Chinese-only output is an intentional, justified locale constraint. This can violate language/locale policy when a specific language is effectively forced without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/COMFYUI.md (reported line 50)May include surrounding context.

工作流定义

}

response = requests.post(url, json={"prompt": workflow}) prompt_id = response.json()["prompt_id"]

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file presents all operational instructions and troubleshooting guidance exclusively in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/CONFIG.md (reported line 81)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加任务
0 5 * * * /usr/bin/python3 /path/to/update-papers.py

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language strings entirely in Chinese, including the module docstring and runtime status messages, with no indication that the skill is region-specific or that users can opt into the locale. Under the policy rules, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file-level natural-language description and user-facing messages are entirely in Chinese, which imposes a specific language/locale without any opt-in or documented regional justification. This matches the policy concern for language or locale constraints that are not optional.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The script sends generated prompts and workflow data to an external ComfyUI server over HTTP, which can expose research metadata and image-generation content to a remote service. Because the default URL uses plain HTTP and there is no authentication, transport security, or host validation, a misconfigured or non-local server could leak data or be intercepted on the network.

Content

Scanner excerpt · scripts/generate-bg.py (reported line 115)May include surrounding context.

python
def submit_task(workflow):
    """提交工作流到 ComfyUI"""
    try:
        resp = requests.post(f"{COMFYUI_URL}/prompt", json={"prompt": workflow}, timeout=30)
        data = resp.json()
        return data.get("prompt_id")
    except Exception as e:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes collecting papers, generating AI background images, and publishing a portal site; invoking arbitrary shell commands via subprocess with shell=True introduces a general command-execution capability unrelated to simple paper aggregation. While LLM-based enrichment may fit the product goal, implementing it as shell execution grants a much broader capability than the skill's stated purpose requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The function builds a prompt from paper metadata and excerpt text, then invokes an external CLI via subprocess, which may transmit that content to a remote LLM service. Although the code comments say it uses an LLM for translation, there is no explicit warning about sending fetched content outside the local process or any confirmation step before doing so.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language prompt explicitly requires a Chinese title and summary, and the script stores the result in Chinese-specific fields. There is no option for the user to choose another language or opt in to the locale constraint, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The code builds a shell command from a dynamic prompt and executes it with shell=True. Because paper titles and abstracts come from external APIs and are inserted directly into the command string, shell metacharacters or quotes in that content can break out of the intended argument and trigger arbitrary command execution on the host.

Content

Scanner excerpt · scripts/update-papers.py (reported line 106)May include surrounding context.

python
概述：xxx"""

    try:
        result = subprocess.run(
            f'{llm_command} "{prompt}"',
            shell=True,
            capture_output=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该文档全文以中文呈现，标题和说明均未提供可选语言、双语说明或对语言限制的合理化说明。根据语言/locale 政策，若技能内容强制单一语言而无用户选择或明确理由，属于自然语言层面的政策风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation shows code that downloads image data and writes it directly to output.png. In this markdown file, there is no accompanying warning that running the example will create or overwrite a local file, which is a user-data-impacting behavior covered by the missing-warnings rule for markdown files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The script reads and then overwrites paper-index.json, writes generated image files under assets/images, and deletes temporary PNG files. Although there are progress prints, there is no explicit user-facing warning or confirmation that metadata will be changed and files will be created and removed on disk.

Content

No source excerpt is available for this finding.