ClawHub
Back to skill

Security audit

Mdtero

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly scoped Mdtero integration, but users should be aware it sends paper content to Mdtero and points to an optional helper installer.

Install is reasonable for users who are comfortable sending selected paper content to Mdtero's API. Do not use it for confidential manuscripts unless that data sharing is acceptable, and verify any optional local helper installer before running it, preferably using publisher-provided checksums or signatures if available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:57
Finding

Unverified Remote Helper Installer Can Execute a Mutable Payload

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-59 and 75-80
Vulnerability Type: Remote payload retrieval and execution without cryptographic verification
Risk Level: Medium

Relevant Code Snippet:

markdown
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.
markdown
When the user needs local acquisition for Elsevier or ScienceDirect, tell them to open the official Mdtero guide at `https://mdtero.com/guide` or the install handoff at `https://api.mdtero.com/skills/install.md`.

Tell them to download the helper installer, review it locally, then run it on their own machine. Explain that the installer auto-detects `python3`, `python`, or `node`, and exposes the `mdtero-local` command without requiring extra packages. Do not recommend piping a remote script directly into the shell.

If they need the exact helper handoff, point them to `https://api.mdtero.com/helpers/install_mdtero_helper.sh` and tell them to save it locally before running it.

Technical Analysis

The Skill directs users to retrieve a shell installer from a mutable external URL and execute it locally. The instructions appropriately discourage piping the remote response directly into a shell and recommend local review, but they do not identify an immutable release version, expected cryptographic checksum, or trusted digital signature.

Consequently, the effective code executed by a user can change after the Skill package has been reviewed. Compromise of the hosting environment, publishing pipeline, or other components in the distribution trust chain could cause the URL to serve altered code. Manual review alone is not a reliable integri ...[truncated 1626 chars]

Remediation
View remediation

Remediation Suggestions

  1. Distribute the helper through immutable, versioned release URLs rather than a mutable installer endpoint.
  2. Publish a SHA-256 or stronger cryptographic digest for every released installer and require users to verify it before execution.
  3. Prefer signed release artifacts and document signature verification using a pinned, independently distributed public key.
  4. Where practical, distribute the helper through a trusted package manager that supports signed metadata and reproducible version pinning.
  5. Pin the expected helper version in SKILL.md and document a deliberate upgrade procedure instead of automatically relying on the latest remote content.
  6. Document the installer's expected files, commands, network destinations, subprocesses, and required permissions so users can meaningfully inspect deviations.
  7. Recommend execution with the least-privileged user account and explicitly state that administrative or root execution is unnecessary.
  8. Retain the existing prohibition against piping a remote script directly into a shell, but treat local review as a supplementary control rather than a substitute for cryptographic integrity verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
- Tell the user that ClawHub install only sets up the agent skill, while the local helper remains a separate install on their own machine.
- Parse and translate requests send paper content or paper-source content to `https://api.mdtero.com`, so do not use this workflow for sensitive or proprietary manuscripts unless the user accepts that boundary.
- If the user needs the local helper, tell them to download the installer, review it locally, then run it on their own machine. Do not recommend piping a remote script directly into the shell.
- If the user wants a fuller install or helper walkthrough, point them to `https://mdtero.com/guide` or `https://api.mdtero.com/skills/install.md`.

## Workflow Rules You Must Preserve

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Open inputs can go directly to POST /tasks/parse.

bash
curl -X POST https://api.mdtero.com/tasks/parse \
  -H "Authorization: ApiKey $MDTERO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": "https://arxiv.org/abs/1706.03762"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples hard-code the target language as zh in both the local helper and API translation commands. This creates a language-specific default in the skill instructions without indicating that the language should be chosen by the user, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.