ClawHub
Back to skill

Security audit

Autonomous Research

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent autonomous-research purpose, but its implementation combines unattended execution with unsafe shell command construction and persistent config mutation.

Install only after reviewing or patching the execution wrapper. At minimum, keep simulated mode enabled, turn approval gates on, use environment variables instead of plaintext API keys, and replace shell-based exec with argument-based spawn/execFile before passing untrusted research topics or enabling sandbox/SSH execution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:106
Finding

Arbitrary Command Execution Through Shell Injection in Research Topic

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:84
Finding

Configuration Injection Through Unsafe YAML String Replacement

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
config.example.yaml:23
Finding

Plaintext API Credential Storage Encouraged by Configuration Template

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
# AutoResearchClaw 技能整合包

**整合日期:** 2026-03-27  
**来源版本:** AutoResearchClaw v0.3.2

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document title and all user-facing instructions are written exclusively in Chinese, and the improvement plan explicitly prioritizes a Chinese interface. For a generally applicable skill README, this creates a locale/language constraint without any opt-in or alternative language option, which matches the language-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advertises fully automated generation of a complete academic paper, code, figures, and citations, but provides no guardrails about data provenance, external API use, authorship integrity, plagiarism, or execution boundaries. In the context of an autonomous 23-stage pipeline with literature retrieval and experiment execution, this can mislead users into triggering broad, potentially unsafe actions or producing deceptive research artifacts without adequate review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This manifest/config template contains user-facing natural-language guidance primarily in Chinese, such as the setup instructions and section comments. Because it does not offer an alternative language or state that the skill is intended only for Chinese-speaking users, it may violate language/locale policy by implicitly forcing a specific language.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 168)May include surrounding context.

md
# =============================================================================
llm:
  # API 端点（OpenAI 兼容）
  base_url: "https://api.openai.com/v1"
  
  # API Key（二选一：使用环境变量或直接填写）
  api_key_env: "OPENAI_API_KEY"  # 推荐：使用环境变量

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.example.yaml (reported line 22)May include surrounding context.

yaml
# =============================================================================
llm:
  # API 端点（OpenAI 兼容）
  base_url: "https://api.openai.com/v1"
  
  # API Key（二选一：使用环境变量或直接填写）
  api_key_env: "OPENAI_API_KEY"  # 推荐：使用环境变量

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The --auto-approve behavior explicitly indicates bypassing manual checkpoints at defined pipeline stages. In this skill's context, that weakens operational oversight for an autonomous system and can let flawed or unsafe decisions propagate through the workflow without intervention.

Content

Scanner excerpt · config.example.yaml (reported line 87)May include surrounding context.

yaml
# =============================================================================
pipeline:
  # 网关阶段是否需要人工审批
  # false = 全自动（--auto-approve）
  # true = 在阶段 5/9/20 暂停等待审批
  require_approval: false

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
76% confidence
Finding

The --auto-approve behavior explicitly indicates bypassing manual checkpoints at defined pipeline stages. In this skill's context, that weakens operational oversight for an autonomous system and can let flawed or unsafe decisions propagate through the workflow without intervention.

Content

Scanner excerpt · config.example.yaml (reported line 87)May include surrounding context.

yaml
# =============================================================================
pipeline:
  # 网关阶段是否需要人工审批
  # false = 全自动（--auto-approve）
  # true = 在阶段 5/9/20 暂停等待审批
  require_approval: false

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level docstring describes an 'Autonomous Research Skill' that turns a topic into a paper, which suggests a content-generation workflow. In reality, the implementation shells out to researchclaw run and exposes execution modes including ssh_remote, while later troubleshooting text indicates network access to OpenAlex, Semantic Scholar, and arXiv, so the comments understate the operational scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The skill explicitly supports skipping approval gates via autoApprove, allowing a 23-stage autonomous pipeline to proceed without human review. In this context, the danger is elevated because the pipeline can run experiments, access external services, and even operate in ssh_remote mode, reducing opportunities to catch harmful actions before execution.

Content

Scanner excerpt · index.js (reported line 27)May include surrounding context.

js
* @param {string} options.topic - Research topic/idea
 * @param {string} options.mode - Experiment mode: 'simulated' | 'sandbox' | 'ssh_remote'
 * @param {string} options.template - Conference template: 'neurips' | 'icml' | 'iclr'
 * @param {boolean} options.autoApprove - Skip gate approvals
 * @param {string} options.model - LLM model to use
 * @returns {Promise<Object>} - Research results
 */

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Setting autoApprove = true by default means the skill will bypass review gates unless the caller actively opts out. Given that the tool runs an external pipeline and supports ssh_remote, this materially increases the chance of unintended or unsafe actions executing automatically.

Content

Scanner excerpt · index.js (reported line 36)May include surrounding context.

js
topic,
    mode = 'simulated',
    template = 'neurips',
    autoApprove = true,
    model,
  } = options;

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · index.js (reported line 45)May include surrounding context.

js
}

  console.log(`🔬 Starting autonomous research on: "${topic}"`);
  console.log(`   Mode: ${mode}, Template: ${template}, Auto-approve: ${autoApprove}`);

  try {
    // Step 1: Ensure configuration exists

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · index.js (reported line 45)May include surrounding context.

js
}

  console.log(`🔬 Starting autonomous research on: "${topic}"`);
  console.log(`   Mode: ${mode}, Template: ${template}, Auto-approve: ${autoApprove}`);

  try {
    // Step 1: Ensure configuration exists

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · index.js (reported line 55)May include surrounding context.

js
}

  console.log(`🔬 Starting autonomous research on: "${topic}"`);
  console.log(`   Mode: ${mode}, Template: ${template}, Auto-approve: ${autoApprove}`);

  try {
    // Step 1: Ensure configuration exists

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · index.js (reported line 112)May include surrounding context.

js
}

  console.log(`🔬 Starting autonomous research on: "${topic}"`);
  console.log(`   Mode: ${mode}, Template: ${template}, Auto-approve: ${autoApprove}`);

  try {
    // Step 1: Ensure configuration exists

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code writes updated preferences back to config.yaml, changing a local file on disk. Although the file operation is commented as an implementation step, there is no explicit user disclosure that the skill will modify configuration state, and the stated purpose focuses on running research rather than editing files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function description hides that it constructs a shell command string and executes it with child_process.exec. Because user-controlled input (topic) is interpolated directly into the command, this is dangerous beyond mere documentation drift: it enables shell command injection and arbitrary command execution in the skill's runtime context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The explicit --auto-approve flag is the mechanism that causes the pipeline to skip approval checkpoints. In an autonomous research skill with experiment execution and remote-capable modes, that can enable unreviewed actions with real operational impact.

Content

Scanner excerpt · index.js (reported line 118)May include surrounding context.

js
'run',
    `--topic "${topic}"`,
    `--config "${CONFIG_FILE}"`,
    autoApprove ? '--auto-approve' : '',
  ].filter(Boolean).join(' ');

  console.log('🚀 Executing pipeline:', args);

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The explicit --auto-approve flag is the mechanism that causes the pipeline to skip approval checkpoints. In an autonomous research skill with experiment execution and remote-capable modes, that can enable unreviewed actions with real operational impact.

Content

Scanner excerpt · index.js (reported line 118)May include surrounding context.

js
'run',
    `--topic "${topic}"`,
    `--config "${CONFIG_FILE}"`,
    autoApprove ? '--auto-approve' : '',
  ].filter(Boolean).join(' ');

  console.log('🚀 Executing pipeline:', args);

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The explicit --auto-approve flag is the mechanism that causes the pipeline to skip approval checkpoints. In an autonomous research skill with experiment execution and remote-capable modes, that can enable unreviewed actions with real operational impact.

Content

Scanner excerpt · index.js (reported line 118)May include surrounding context.

js
'run',
    `--topic "${topic}"`,
    `--config "${CONFIG_FILE}"`,
    autoApprove ? '--auto-approve' : '',
  ].filter(Boolean).join(' ');

  console.log('🚀 Executing pipeline:', args);

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The generated summary strings and troubleshooting suggestions are written in Chinese, which imposes a language choice on users. The file does not provide opt-in, fallback, or justification for a Chinese-only locale, so this violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description 'Autonomous research pipeline - from idea to paper' is very broad and could match many general research-related requests without specifying boundaries, triggers, or exclusions for when the skill should be invoked.

Content

No source excerpt is available for this finding.