paper-lark-report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:30 AM UTC
• Version: 1.1.1

Overview

The skill’s research-report workflow is mostly coherent, but it handles Feishu credentials unsafely and has an argument path issue that can overwrite JSON files outside its intended log directory.

Review before installing. Use only with a Feishu app whose permissions are narrowly scoped to the intended Wiki location, avoid shared logs until token-fragment logging is removed, and run the save/register commands only with trusted arguments. Prefer a pinned installer version instead of `clawhub@latest` in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_feishu_doc.py:157
• Finding: Feishu Tenant Access Token Fragment Exposed in Logs## Vulnerability Details **File Location**: `scripts/create_feishu_doc.py:157` **Vulnerability Type**: Sensitive credential disclosure through application logs **Risk Level**: Medium **Vulnerable Code**: ```python # Get token token = load_token() print(f"Token loaded: {token[:20]}...") ``` ### Technical Analysis After obtaining a live Feishu tenant access token, the application writes its first 20 characters to standard output. This disclosure is unnecessary for the document-creation workflow. Standard output from scheduled jobs and agent executions may be retained in cron logs, CI logs, centralized logging systems, terminal histories, or agent transcripts. Anyone with access to those records can obtain the disclosed credential fragment. Although the fragment alone may not be sufficient to authenticate, exposing any portion of an active bearer token weakens credential confidentiality and can facilitate token correlation or reconstruction when combined with other disclosures. ### Attack Path 1. A legitimate user or scheduled process runs `scripts/create_feishu_doc.py`. 2. The script reads the Feishu application credentials from `~/.openclaw/openclaw.json`. 3. The script exchanges those credentials for a tenant access token. 4. The first 20 characters of the token are printed to standard output. 5. A logging service, shared automation platform, or user with log access captures the token fragment. 6. The fragment may be correlated with other leaked authentication data or retained after the intended execution context ends. ### Impact Assessment The issue exposes a fragment of Feishu authentication material to every system or user that can read process logs. It does not, by itself, establish that an attacker can authenticate using the fragment alone. If combined with another partial disclosure or vulnerable token format, however, it may contribute to unauthorized access within the permissions granted to the Feishu app ...[truncated 170 chars]
• Remediation: ## Remediation Suggestions Remove all credential-derived values from logs: ```python token = load_token() print("Feishu tenant access token obtained successfully") ``` Additional hardening measures: - Never log complete or partial bearer tokens, application secrets, authorization headers, or token-exchange responses. - Configure automation and centralized logging systems to redact credential patterns as a defense-in-depth measure. - Restrict access to logs generated by scheduled and agent-driven executions. - Rotate the Feishu application secret if token material has previously been retained in broadly accessible logs. - Ensure that exceptions from authentication operations do not include request bodies containing `app_secret`.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Mutable Package Execution Through Unpinned npx Installation Command## Vulnerability Details **File Location**: `SKILL.md:8-11` **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium **Vulnerable Code**: ```bash # Installation method 1: install through ClawHub npx clawhub@latest install leogoat2004/paper-lark-report ``` ### Technical Analysis The documented installation command instructs users to download and execute the mutable `latest` release of the `clawhub` package. The code executed by a future invocation is therefore not fixed to the version that was reviewed during this audit. `npx` can retrieve a package from the configured package registry and execute its command-line entry point. If the package publisher account, registry distribution, or a future release is compromised, users following the installation instructions may execute attacker-controlled code with their local account privileges. This finding concerns the installation guidance. The audited project itself does not automatically invoke this command. ### Attack Path 1. An attacker compromises the package publisher account, release process, or registry artifact associated with `clawhub`. 2. The attacker publishes a malicious version and causes it to resolve as `latest`. 3. A user follows the command in `SKILL.md`. 4. `npx` downloads the mutable package release and executes its entry point. 5. The malicious package runs with the permissions of the user performing the installation. 6. Depending on those permissions, it may read user files, steal credentials, modify local configuration, or install additional payloads. ### Impact Assessment Successful exploitation permits arbitrary code execution under the installing user’s account. Accessible resources may include project files, environment variables, OpenClaw configuration, Feishu application credentials, and other files readable or writable by that user. System-wide privileges are not inherently obtained. The ult ...[truncated 142 chars]
• Remediation: ## Remediation Suggestions Pin the installer to a specific reviewed version rather than using `@latest`: ```bash npx clawhub@<reviewed-version> install leogoat2004/paper-lark-report ``` Additional hardening measures: - Document the exact version validated by the project maintainers. - Use package-manager lockfiles and integrity hashes where supported. - Verify package provenance, signatures, and registry ownership before execution. - Review release notes and package contents before updating the pinned version. - Avoid running installation commands with administrator or root privileges. - In sensitive environments, install from an internally mirrored and approved artifact.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/paper_lark_report.py:177
• Finding: Path Traversal Through Unvalidated Archive Date Argument## Vulnerability Details **File Locations**: `scripts/paper_lark_report.py:177-187` and `scripts/paper_lark_report.py:221-227` **Vulnerability Type**: Path traversal and out-of-directory file overwrite **Risk Level**: Medium **Vulnerable Code**: ```python def save_selected_papers(date: str, papers: list): PROCESSED_LOG_DIR.mkdir(parents=True, exist_ok=True) log_file = PROCESSED_LOG_DIR / f"{date}.json" with open(log_file, "w", encoding="utf-8") as f: json.dump({ "date": date, "papers": papers, "generated_at": datetime.now().isoformat(), }, f, ensure_ascii=False, indent=2) ``` The value reaches this function directly from a command-line argument: ```python if args.save_selected: date_str, papers_json = args.save_selected with open(papers_json, "r", encoding="utf-8") as f: data = json.load(f) # Support both a bare list and a {"date":..., "papers":[...]} wrapper papers = data if isinstance(data, list) else data.get("papers", []) save_selected_papers(date_str, papers) ``` ### Technical Analysis The `DATE` command-line argument is used as part of an output path without validating that it is a calendar date or verifying that the resolved destination remains within `processed_log`. A value containing traversal components, such as `../../target`, produces a path outside the intended archive directory. An absolute date argument can also cause `pathlib` to discard the preceding `PROCESSED_LOG_DIR`. The script then opens the resulting path in write mode, truncating any existing writable file at that location. The `.json` suffix is always appended, limiting the most direct overwrite targets to names ending in `.json`. Nevertheless, configuration, state, or application data stored in writable JSON files can be replaced. ### Attack Path 1. An attacker obtains the ability to invoke the CLI, influence an automation co ...[truncated 1269 chars]
• Remediation: ## Remediation Suggestions Validate the argument as an exact ISO calendar date before constructing the path: ```python from datetime import datetime def validate_date(date: str) -> str: parsed = datetime.strptime(date, "%Y-%m-%d") normalized = parsed.strftime("%Y-%m-%d") if normalized != date: raise ValueError("DATE must use the exact YYYY-MM-DD format") return normalized ``` Then enforce containment after resolving the path: ```python def save_selected_papers(date: str, papers: list): date = validate_date(date) PROCESSED_LOG_DIR.mkdir(parents=True, exist_ok=True) base_dir = PROCESSED_LOG_DIR.resolve() log_file = (base_dir / f"{date}.json").resolve() if log_file.parent != base_dir: raise ValueError("Archive path escapes processed_log") with open(log_file, "w", encoding="utf-8") as f: json.dump( { "date": date, "papers": papers, "generated_at": datetime.now().isoformat(), }, f, ensure_ascii=False, indent=2, ) ``` Additional hardening measures: - Reject date values containing path separators, traversal components, or unexpected characters. - Run the Skill under a dedicated low-privilege account with limited filesystem write access. - Use atomic file replacement to reduce corruption risks. - Apply restrictive permissions to archive and state directories. - Validate the structure and size of the supplied papers JSON before persisting it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documentation describes storing paper data and document registry artifacts locally and pushing generated content to Feishu Wiki, but it does not clearly warn users about persistence and external transmission. This can lead to unintended disclosure of research interests, generated summaries, document tokens/URLs, or other operational metadata to local disk and third-party services.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The installation instructions use `npx clawhub@latest`, which pulls and executes the most recent published package version at install time without pinning. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users of the skill may execute unreviewed code.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prints the first 20 characters of the Feishu tenant access token to stdout, which constitutes partial secret disclosure. Even partial tokens can aid attackers through log scraping, correlation, or accidental exposure in CI/CD logs, terminals, or shared observability systems, especially because this script handles real production authentication material.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instruction 'IMPORTANT: write in Chinese' mandates a specific language for the analysis. There is no opt-in, alternative language option, or documented reason that this skill must operate only in Chinese, so it violates the language/locale policy criteria.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The template instructs creating a Feishu wiki document and populating it with report content, which transmits data to an external service without any disclosure, consent step, or boundary on what may be shared. Even though the content is research-oriented, automatic exfiltration to third-party platforms can leak sensitive research direction, selected documents, internal summaries, or metadata.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The report title and field labels are written entirely in Chinese, which indicates the skill is designed to generate output in a specific language. The file does not provide any user opt-in, language selection, or documentation that this is a region-specific skill, so this is a natural-language locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The workflow explicitly says motivation and core_innovation are extracted in Chinese, and the selected results directory note also says it contains Chinese analysis. This is a natural-language policy concern because the skill mandates a specific language/locale without indicating user opt-in or configurability.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: This markdown file explicitly directs the agent to write selected paper data to `data/selected_papers.json`, which is a file-modifying operation. The template does not include any warning that the skill will create or overwrite local files, so users may not be aware that running it changes workspace data.

Static analysis

No suspicious patterns detected.