T09 · Insecure Skill Coding Practices
Warning
- Location
agent.py:824- Finding
Caller-Controlled Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Literature Search
Security checks for vulnerabilities and agentic risk
Overview
This academic search skill is mostly purpose-aligned, but it needs Review because saving results can overwrite arbitrary local files and arXiv queries use plaintext HTTP.
Review before installing in an agent with broad filesystem access. Use it only if you are comfortable sending search terms to external scholarly services, avoid enabling save_results/output_file unless confined to a safe directory, prefer changing arXiv to HTTPS, and pin dependencies before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
agent.py:89- Finding
arXiv Search Traffic Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README indicates
auto_save: truefor output behavior, which means search results may be written to disk automatically without a clear warning to users. In an agent/skill context, automatic persistence can expose sensitive queries, research topics, or retrieved metadata to other local users, backups, or logging/collection systems, especially when users assume the tool is read-only.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents all user-facing instructions and descriptions exclusively in Chinese, which can amount to a language policy violation when no user opt-in or alternative locale is offered. The documented skill is not framed as region-specific or justified as Chinese-only, so the forced locale appears unconditional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring includes a Chinese-only description and the rest of the skill's user-facing strings are also written in Chinese, indicating an implicit fixed-language experience. There is no visible opt-in, language selection mechanism, or documented justification that this skill is intentionally region- or locale-specific.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill transmits user-supplied search queries to external third-party services (Semantic Scholar) as part of its core function. This is expected behavior for a literature-search tool, but it is still a real data-exposure risk because queries may contain sensitive research topics, internal project names, or confidential terms, and the code provides no consent prompt, redaction, or data-classification guardrails.
- Content
python # API配置 self.api_config = { "semantic_scholar": { "base_url": "https://api.semanticscholar.org/graph/v1", "api_key": os.getenv("SEMANTIC_SCHOLAR_API_KEY", ""), }, "crossref": {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill sends user queries to Crossref over the network, exposing potentially sensitive search terms to an external provider. Although this is aligned with the tool’s purpose, it remains a genuine confidentiality concern in agent settings where users may not realize their input leaves the local environment.
- Content
python "api_key": os.getenv("SEMANTIC_SCHOLAR_API_KEY", ""), }, "crossref": { "base_url": "https://api.crossref.org/works", "email": os.getenv("CROSSREF_API_EMAIL", "openclaw@example.com"), }, "pubmed": {
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill accepts a user-controlled output_file path and writes results there without restricting the destination to a safe workspace directory. In an agent context, this creates arbitrary file write capability that exceeds the expected scope of a literature-search skill and can overwrite local files, drop data into sensitive locations, or be abused for persistence/config tampering if the agent runs with broader filesystem access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The save_results/output_file flow permits writing search output to an arbitrary filesystem path with no user-visible warning, path validation, or sandboxing. In an automated agent environment, this can be abused to plant or overwrite files outside the expected results area, making the skill materially more dangerous than its stated purpose suggests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description is written only in Chinese ('专业的学术文献检索工具...') and provides no indication that users can choose another language or locale. This can violate language/locale policy when a skill is presented in a multilingual environment without explicit opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language content in the README consistently uses Chinese and does not indicate any option for other languages or that the locale restriction is intentional. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy issue.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The code creates a cache directory and defines cache-related configuration and an in-memory cache field, suggesting caching behavior as part of the skill's operation. However, the search flow never stores or retrieves cached search results, so the comments/configuration imply behavior that the implementation does not perform.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency specifier uses a lower bound only, which allows future releases to be installed without review or testing. This creates supply-chain and reproducibility risk because a later vulnerable or breaking version could be resolved at install time.
- Content
text # Python >= 3.8 required # Core dependencies requests>=2.28.0 aiohttp>=3.8.0 pandas>=1.5.0 pyyaml>=6.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Requests has known advisories, and because the manifest does not pin a specific version, it is impossible to determine from this file whether deployment will use an affected release. The immediate issue is not confirmed exploitation, but an unverifiable and potentially vulnerable dependency state.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The aiohttp dependency is not pinned to an exact version, so installations may pull in unexpected future releases. That weakens build reproducibility and can expose the project to newly introduced vulnerable versions or malicious supply-chain changes.
- Content
text # Core dependencies requests>=2.28.0 aiohttp>=3.8.0 pandas>=1.5.0 pyyaml>=6.0 aiofiles>=23.0.0
Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Aiohttp has multiple known advisories, but the open-ended version constraint prevents verification that installs will avoid affected releases. This creates a dependency hygiene gap that can allow vulnerable versions into different environments unnoticed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using pandas>=1.5.0 permits any later version, making dependency resolution non-deterministic across environments. This increases the chance of pulling vulnerable or incompatible releases and complicates incident response and auditing.
- Content
text # Core dependencies requests>=2.28.0 aiohttp>=3.8.0 pandas>=1.5.0 pyyaml>=6.0 aiofiles>=23.0.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Pandas has an advisory history, and without an exact version the project cannot demonstrate that installed environments are free from known issues. The risk here is uncertainty and lack of verifiable safety rather than evidence that this file definitely installs a vulnerable build.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
PyYAML is specified with only a minimum version, leaving room for unreviewed versions to be installed. Given PyYAML's history of unsafe deserialization issues, lack of strict pinning increases uncertainty and supply-chain exposure.
- Content
text requests>=2.28.0 aiohttp>=3.8.0 pandas>=1.5.0 pyyaml>=6.0 aiofiles>=23.0.0
Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
PyYAML has multiple historical vulnerabilities involving unsafe parsing, and the manifest does not pin a version, so affected releases cannot be ruled out. In a literature-search skill, YAML may plausibly be used for configuration, making this more concerning if any untrusted YAML is ever processed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The aiofiles dependency is unpinned, so the installed version may vary over time and across systems. That opens the door to reproducibility problems and potential exposure to future vulnerable or compromised releases.
- Content
text aiohttp>=3.8.0 pandas>=1.5.0 pyyaml>=6.0 aiofiles>=23.0.0
Static analysis
No suspicious patterns detected.