Research Daily Push

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its stated research-summary purpose, but it has review-worthy implementation risks around dependency installation, plaintext arXiv requests, and unescaped external report content.

Review before installing. Prefer a version that uses HTTPS for arXiv, validates arXiv links, escapes Markdown output, and declares Python dependencies in a Python requirements file rather than npm package dependencies. Only enable the documented cron schedule or external push settings when you are comfortable sharing research topics, summaries, and destination identifiers with the relevant services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: research_push.py:25

Finding

Plaintext arXiv API Communication Permits Interception and Response Tampering

Content

View full analysis

Vulnerability Details

File Location: research_push.py, lines 25-57
Vulnerability Type: Cleartext external API communication
Risk Level: Medium

Vulnerable Code

python

def __init__(self):
    self.base_url = "http://export.arxiv.org/api/query"
    self.headers = {"User-Agent": "OpenClaw-Research-Push/1.0"}

python

response = requests.get(
    self.base_url,
    params=params,
    headers=self.headers,
    timeout=30
)
response.raise_for_status()

Technical Analysis

The arXiv API endpoint uses plaintext HTTP rather than HTTPS. Consequently, the initial request—including the user's research query—is not protected by transport encryption or server authentication.

An attacker with a network-level interception position can inspect the research query or modify the HTTP response. Because the returned XML is parsed and its titles, abstracts, authors, and links are incorporated into the generated report, response tampering can introduce misleading content or attacker-selected links.

Even if the server redirects HTTP requests to HTTPS, the initial HTTP request remains susceptible to interception. An attacker may replace the redirect or provide a forged response before a secure connection is established.

Attack Path

1. A user invokes the skill with a research topic.
2. The skill sends the query to http://export.arxiv.org/api/query.
3. An attacker positioned on the local network, proxy, gateway, or another network transit point intercepts the plaintext request.
4. The attacker reads the research query or returns a modified Atom XML response.
5. The application accepts and parses the modified response.
6. Attacker-controlled titles, summaries, author information, or PDF links are displayed in the generated report.
7. A user may rely on falsified information or follow an attacker-controlled link.

Impact Assessment

This issue can expose users' research intere ...[truncated 314 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the endpoint with https://export.arxiv.org/api/query.
• Retain the default TLS certificate verification provided by requests.
• Reject redirects that downgrade a request from HTTPS to HTTP.
• Validate the final response URL and require the https scheme and expected arXiv hostname.
• Continue using a finite timeout and consider separate connection and read timeouts.
• Validate response content type and structure before processing it.
• Sanitize all remote metadata before inserting it into a report.

T08 · Insecure Dependencies

Warning

• Location: package.json:20

Finding

Python Dependency Incorrectly Declared as an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: package.json, lines 20-22
Vulnerability Type: Cross-ecosystem dependency confusion and unsafe version constraint
Risk Level: Medium

Vulnerable Code

json

"dependencies": {
  "requests": ">=2.31.0"
}

Technical Analysis

The implementation imports the Python requests library, but the dependency is declared in package.json, which is processed by npm. npm therefore resolves a JavaScript package named requests; it does not install the Python package required by research_push.py.

This cross-ecosystem declaration may cause users or automated installation systems to install an unrelated npm package under the assumption that it is the required Python dependency. The version constraint is also broad, and the project contains no lockfile to establish a reviewed dependency graph.

If an incorrectly selected package, a future release, or one of its transitive dependencies contains malicious lifecycle behavior, installation may execute that behavior with the privileges of the user running npm.

Attack Path

1. A user or deployment system discovers package.json and runs npm install.
2. npm resolves requests from the npm registry rather than installing Python's requests distribution.
3. npm installs the unrelated package and its transitive dependencies according to the broad version constraint.
4. Any lifecycle scripts associated with the resolved dependency graph may execute during installation.
5. If the package, maintainer account, or dependency chain is compromised, attacker code executes with the installing user's permissions.
6. The required Python dependency may remain unavailable, causing the application to fail despite the unsafe package installation.

Impact Assessment

The direct scope is the dependency installation environment. A malicious package or lifecycle script could access files, environment variables, network resources, ...[truncated 341 chars]

Remediation

View remediation

Remediation Suggestions

• Remove requests from package.json.
• If no JavaScript runtime is required, remove package.json or leave it without runtime dependencies.
• Declare Python dependencies in requirements.txt or pyproject.toml.
• Pin the Python dependency to a reviewed version or tightly controlled compatible range.
• Use a generated lockfile and verified hashes for reproducible installations.
• Run dependency vulnerability scanning against the Python dependency set.
• Disable package lifecycle scripts where feasible in automated installation environments.

T09 · Insecure Skill Coding Practices

Warning

• Location: research_push.py:246

Finding

Untrusted arXiv Metadata Is Embedded in Markdown Without Escaping or URL Validation

Content

View full analysis

Vulnerability Details

File Location: research_push.py, lines 246-269
Vulnerability Type: Markdown content injection and unsafe link rendering
Risk Level: Medium

Vulnerable Code

python

for i, paper in enumerate(sorted_papers[:10], 1):
    title = paper.get("title", "No title")[:50] + "..." if len(
        paper.get("title", "")
    ) > 50 else paper.get("title", "")
    authors = paper.get("authors", "Unknown")
    score = "⭐" * min(
        5, (paper.get("relevance_score", 0) + 1) // 2
    )
    pdf_link = paper.get("pdf_link", "")

    report.append(
        f"| {i}. {title} | {authors} | {score} | [PDF]({pdf_link}) |"
    )

python

for i, paper in enumerate(sorted_papers[:5], 1):
    report.append(f"### {i}. {paper.get('title', 'No title')}\n")
    report.append(f"**Authors:** {paper.get('authors', 'Unknown')}")

    summary = paper.get("summary", "")
    if summary:
        report.append(f"**Core content:**\n{summary}\n")

The displayed English fallback labels above correspond to the original non-English labels; the vulnerable interpolation operations are unchanged.

Technical Analysis

Paper titles, author names, summaries, and PDF URLs originate in an external XML response. These values are inserted directly into Markdown tables, headings, paragraphs, and link destinations without contextual escaping or URL validation.

Markdown metacharacters such as pipes, brackets, parentheses, and line breaks can alter report structure. Raw HTML or crafted Markdown may also be interpreted by permissive renderers. The PDF link is accepted without verifying its scheme or hostname, allowing a manipulated response to display an attacker-selected destination behind a trusted-looking PDF label.

Exploitation could originate from maliciously crafted source metadata or from response modification enabled by the plaintext HTTP connection.

Attack Path

1. An attacker p ...[truncated 1169 chars]

Remediation

View remediation

Remediation Suggestions

• Escape Markdown metacharacters according to context before rendering titles, authors, and summaries.
• Replace or encode table-breaking characters such as |, carriage returns, and line feeds.
• Strip or encode raw HTML unless the destination renderer guarantees safe sanitization.
• Parse every external link and permit only the https scheme.
• Restrict PDF and paper links to expected arXiv hostnames, such as arxiv.org and explicitly approved subdomains.
• Reject credentials, control characters, and unexpected schemes such as javascript:, data:, or file:.
• Consider generating a structured data object and using a Markdown templating library with explicit escaping instead of direct string interpolation.
• Apply sanitization again at the final delivery boundary because different messaging platforms implement different Markdown and HTML dialects.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises automatic pushing of generated summaries to external channels and documents PUSH_CHANNEL/PUSH_TARGET, but it does not warn users that content and recipient identifiers may be transmitted to third-party services. In a research workflow, pushed summaries, user interests, schedules, and destination identifiers can reveal sensitive project focus or personal information, making silent transmission a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The listed trigger phrases are generic natural-language requests such as '设置文献早报' and '推送今日最新文献', which can plausibly appear in ordinary conversation and unintentionally invoke the skill. Because the skill can initiate automated monitoring and outbound pushing, accidental activation could cause unwanted actions, notifications, or configuration changes without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents the skill as Chinese-only in its primary description and later emits Chinese-language report content and CLI usage text. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description, argument hint, headings, and usage examples are all written in Chinese, which effectively imposes a specific language on users. The file does not indicate that other languages are supported or that the Chinese-only presentation is a justified regional requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package description is written entirely in Chinese and presents the skill in a single fixed language. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.