时空智能分析法

• Outcome: Review
• Latest audit: Sep 8, 2026 · 1:09 AM UTC
• Version: 2.0.2

Overview

This research skill is mostly coherent, but it also includes broad skill-management instructions, persistent home-directory writes, and an unsafe external Python import that warrant careful review before installation.

Install only if you want a high-capability research workflow and are comfortable reviewing its file-writing behavior first. Before use, narrow its triggers, remove or isolate the global skill lifecycle section, replace the hard-coded external Python import with a pinned dependency, make cache and output paths user-confirmed, and avoid running it on sensitive workspaces without checking what it will read or copy.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:340
• Finding: Research Skill Directs Broad Access to Unrelated Skill Directories<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 340-399 **Vulnerability Type**: Least-privilege violation through unrelated filesystem administration **Risk Level**: Medium ### Vulnerable Code or Instructions ```bash find <old-version-directory> -type f -exec wc -l {} \; > /tmp/old_files.txt find <new-version-directory> -type f -exec wc -l {} \; > /tmp/new_files.txt diff /tmp/old_files.txt /tmp/new_files.txt grep -E "^description:" <old-version-SKILL.md> | head -1 grep -E "^description:" <new-version-SKILL.md> | head -1 ls <old-version-directory>/scripts/ <old-version-directory>/templates/ 2>/dev/null ls <new-version-directory>/scripts/ <new-version-directory>/templates/ 2>/dev/null mkdir -p ~/.hermes/.<skill-name>-merge-backup-YYYYMMDD/ cp -r <old-version-directory> ~/.hermes/.<skill-name>-merge-backup-YYYYMMDD/v<old-version-number> cp -r <second-old-version-directory> ~/.hermes/.<skill-name>-merge-backup-YYYYMMDD/v<second-old-version-number> ``` The accompanying decision table permits deletion when the new version is considered to cover the old version completely. ### Technical Analysis The Skill declares research analysis and report generation as its primary function. However, its lifecycle section explicitly applies to any Skill merge, rewrite, or deletion and directs the Agent to enumerate, read, compare, and recursively copy unrelated Skill directories. These operations are not required to perform spatiotemporal research. Recursive copying is especially sensitive because another Skill directory may contain credentials, private configuration, proprietary source code, local user data, or references to sensitive resources. The backup location is persistent and does not define restrictive permissions, secret filtering, retention enforcement, or ownership validation. The instructions also allow the workflow to decide that another Skill may be deleted after a content-coverage assessment. No deletion command is embedded in the ...[truncated 1660 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the lifecycle-management section from this research Skill. 2. Move Skill merging, migration, backup, and deletion into a separate administrative Skill that is invoked explicitly. 3. Require users to identify exact source and destination paths; never infer administrative targets from similar names or trigger descriptions. 4. Restrict traversal to an approved Skill root and reject symlinks or paths escaping that root. 5. Inventory files before backup and exclude credentials, tokens, private keys, session data, environment files, and user documents. 6. Create backups with restrictive permissions and a documented retention period. 7. Require explicit confirmation immediately before every recursive copy, modification, or deletion. 8. Use a dry-run manifest that lists all affected files and expected changes. 9. Never treat content similarity or trigger-word overlap as sufficient deletion authority. 10. Verify backup integrity and successful restoration before allowing any destructive operation. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/spatiotemporal_fetcher.py:66
• Finding: Unverified Python Module Executed from a Hard-Coded External Skill Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/spatiotemporal_fetcher.py`, lines 66-70 **Vulnerability Type**: Unsafe loading of an unpinned external executable dependency **Risk Level**: Medium ### Vulnerable Code ```python def __init__(self): try: sys.path.insert(0, '/Users/neocross/.hermes/skills/openclaw-imports/academic-workflow/scripts') from research import search_openalex, search_arxiv self.search_openalex = search_openalex ``` ### Technical Analysis The fetcher prepends a hard-coded directory outside the audited package to Python's module search path and then imports `research`. Importing a Python module executes its top-level code. The external module is not included in this audit, version-pinned, integrity-checked, or authenticated. Because the directory is inserted at index zero, a file named `research.py` at that location takes precedence over modules from normal dependency locations. This creates a supply-chain execution boundary: the effective code run by the fetcher can change independently after this Skill has been reviewed. It also makes behavior dependent on one developer-specific filesystem layout. ### Attack Path 1. An attacker, compromised installer, malicious Skill package, or another process gains write access to the hard-coded `academic-workflow/scripts` directory. 2. The attacker creates or replaces `research.py` with code containing an import-time payload. 3. A user starts `spatiotemporal_fetcher.py`. 4. The constructor prepends the attacker-controlled directory to `sys.path`. 5. Python resolves `from research import ...` from that directory. 6. The malicious module's top-level code executes before the expected search functions are used. 7. The payload receives all permissions of the user running the fetcher. This path requires the attacker or another compromised component to obtain write access to the referenced dependency directory. The audited project itself does not download or ...[truncated 632 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the hard-coded `sys.path` modification with a declared and version-pinned package dependency. 2. Prefer a stable, documented Skill API over importing executable source from another Skill directory. 3. Package the required search interface as a normal Python module with an exact version and integrity-verified distribution. 4. If local Skill integration is unavoidable, resolve the dependency through trusted configuration rather than a developer-specific absolute path. 5. Validate that the resolved dependency remains inside an approved directory and is not a symbolic-link escape. 6. Record and verify a cryptographic hash or signed manifest before importing external source. 7. Avoid `sys.path.insert(0, ...)`; use an isolated import mechanism that cannot shadow unrelated modules. 8. Run external search integrations in a restricted subprocess with minimal filesystem and network permissions. 9. Fail closed when dependency identity or integrity cannot be verified. 10. Document the external dependency and its security boundary in the Skill manifest. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes and instructs use of shell commands, filesystem access, network retrieval, and file generation/upload workflows, but does not declare permissions or capability boundaries. This creates a transparency and consent problem: a caller may invoke what appears to be a research methodology skill without realizing it can read local files, write reports/PDFs, and interact with external resources, increasing the risk of unintended data exposure or destructive side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence
• Finding: The declared description presents the skill primarily as a methodology/reporting aid, but the body operationalizes broader behavior including external searches, imported tooling, local caching, shell commands, auditing, and PDF generation. That mismatch can cause users or routing systems to trust and auto-invoke the skill in contexts where they did not expect active tool use or local data handling, which materially increases the chance of overbroad execution and privacy leakage.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script prepends a hard-coded external directory to sys.path and imports executable Python code from there. That creates a trust-boundary violation: if that path's contents are modified or replaced, this script will execute attacker-controlled code on import, and the behavior is outside the reviewed file's integrity guarantees.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are very broad and include common requests like deep research, competitive analysis, or studying the relationship between X and Y, which can match many benign user prompts. Overbroad triggering is dangerous because it may route unrelated tasks into a high-capability skill that performs search, shell, file, and upload-oriented workflows, causing unintended data handling or actions beyond user expectations.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation section repeats ambiguous patterns such as generic 'deep research' and 'research X' phrasing without hard scope boundaries, making accidental activation likely. In this skill's context, accidental activation matters more because the instructions include external retrieval, local file inspection, shell usage, and upload/PDF workflows, so a routing mistake can lead to unnecessary access to tools and data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly implements persistent local caching of query strings and fetched results under the user's home directory for 7 days, but provides no consent, warning, opt-out, or data-minimization controls. Because research queries may contain sensitive topics, internal project names, client names, or investigative targets, this creates a realistic privacy and data-exposure risk through local disk retention, backups, shared machines, or later compromise of the host.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The methodology content is entirely written in Chinese and presents prescriptive output requirements without indicating that the agent should adapt to the user's requested language. In practice, this can cause the skill to override user preference or system expectations, degrading usability, causing misunderstanding, and potentially making downstream review or safety checks less reliable when operators expect another language.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs writing output to a fixed local desktop path without any requirement for user confirmation or environment checks. In an agent setting, this can cause unauthorized local file writes, privacy leakage about the user's filesystem conventions, or unintended overwriting of existing documents if the agent operationalizes the instruction automatically.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Mandating Chinese-only output removes user choice and can override the user's preferred language or accessibility needs. In an agent workflow this is risky because it may cause misunderstanding of safety warnings, consent prompts, file actions, or research limitations if the user cannot fully understand the generated content.

Static analysis

No suspicious patterns detected.