paper-lark-report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:30 AM UTC
• Version: 1.1.1

Overview

The skill’s research-report workflow is mostly coherent, but it handles Feishu credentials unsafely and has an argument path issue that can overwrite JSON files outside its intended log directory.

Review before installing. Use only with a Feishu app whose permissions are narrowly scoped to the intended Wiki location, avoid shared logs until token-fragment logging is removed, and run the save/register commands only with trusted arguments. Prefer a pinned installer version instead of `clawhub@latest` in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_feishu_doc.py:157

Finding

Feishu Tenant Access Token Fragment Exposed in Logs

Content

View full analysis

Vulnerability Details

File Location: scripts/create_feishu_doc.py:157
Vulnerability Type: Sensitive credential disclosure through application logs
Risk Level: Medium

Vulnerable Code:

python

# Get token
token = load_token()
print(f"Token loaded: {token[:20]}...")

Technical Analysis

After obtaining a live Feishu tenant access token, the application writes its first 20 characters to standard output. This disclosure is unnecessary for the document-creation workflow.

Standard output from scheduled jobs and agent executions may be retained in cron logs, CI logs, centralized logging systems, terminal histories, or agent transcripts. Anyone with access to those records can obtain the disclosed credential fragment. Although the fragment alone may not be sufficient to authenticate, exposing any portion of an active bearer token weakens credential confidentiality and can facilitate token correlation or reconstruction when combined with other disclosures.

Attack Path

1. A legitimate user or scheduled process runs scripts/create_feishu_doc.py.
2. The script reads the Feishu application credentials from ~/.openclaw/openclaw.json.
3. The script exchanges those credentials for a tenant access token.
4. The first 20 characters of the token are printed to standard output.
5. A logging service, shared automation platform, or user with log access captures the token fragment.
6. The fragment may be correlated with other leaked authentication data or retained after the intended execution context ends.

Impact Assessment

The issue exposes a fragment of Feishu authentication material to every system or user that can read process logs. It does not, by itself, establish that an attacker can authenticate using the fragment alone. If combined with another partial disclosure or vulnerable token format, however, it may contribute to unauthorized access within the permissions granted to the Feishu app ...[truncated 170 chars]

Remediation

View remediation

Remediation Suggestions

Remove all credential-derived values from logs:

python

token = load_token()
print("Feishu tenant access token obtained successfully")

Additional hardening measures:

• Never log complete or partial bearer tokens, application secrets, authorization headers, or token-exchange responses.
• Configure automation and centralized logging systems to redact credential patterns as a defense-in-depth measure.
• Restrict access to logs generated by scheduled and agent-driven executions.
• Rotate the Feishu application secret if token material has previously been retained in broadly accessible logs.
• Ensure that exceptions from authentication operations do not include request bodies containing app_secret.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Mutable Package Execution Through Unpinned npx Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-11
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code:

bash

# Installation method 1: install through ClawHub
npx clawhub@latest install leogoat2004/paper-lark-report

Technical Analysis

The documented installation command instructs users to download and execute the mutable latest release of the clawhub package. The code executed by a future invocation is therefore not fixed to the version that was reviewed during this audit.

npx can retrieve a package from the configured package registry and execute its command-line entry point. If the package publisher account, registry distribution, or a future release is compromised, users following the installation instructions may execute attacker-controlled code with their local account privileges.

This finding concerns the installation guidance. The audited project itself does not automatically invoke this command.

Attack Path

1. An attacker compromises the package publisher account, release process, or registry artifact associated with clawhub.
2. The attacker publishes a malicious version and causes it to resolve as latest.
3. A user follows the command in SKILL.md.
4. npx downloads the mutable package release and executes its entry point.
5. The malicious package runs with the permissions of the user performing the installation.
6. Depending on those permissions, it may read user files, steal credentials, modify local configuration, or install additional payloads.

Impact Assessment

Successful exploitation permits arbitrary code execution under the installing user’s account. Accessible resources may include project files, environment variables, OpenClaw configuration, Feishu application credentials, and other files readable or writable by that user.

System-wide privileges are not inherently obtained. The ult ...[truncated 142 chars]

Remediation

View remediation

Remediation Suggestions

Pin the installer to a specific reviewed version rather than using @latest:

bash

npx clawhub@<reviewed-version> install leogoat2004/paper-lark-report

Additional hardening measures:

• Document the exact version validated by the project maintainers.
• Use package-manager lockfiles and integrity hashes where supported.
• Verify package provenance, signatures, and registry ownership before execution.
• Review release notes and package contents before updating the pinned version.
• Avoid running installation commands with administrator or root privileges.
• In sensitive environments, install from an internally mirrored and approved artifact.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/paper_lark_report.py:177

Finding

Path Traversal Through Unvalidated Archive Date Argument

Content

View full analysis

Vulnerability Details

File Locations: scripts/paper_lark_report.py:177-187 and scripts/paper_lark_report.py:221-227
Vulnerability Type: Path traversal and out-of-directory file overwrite
Risk Level: Medium

Vulnerable Code:

python

def save_selected_papers(date: str, papers: list):
    PROCESSED_LOG_DIR.mkdir(parents=True, exist_ok=True)
    log_file = PROCESSED_LOG_DIR / f"{date}.json"
    with open(log_file, "w", encoding="utf-8") as f:
        json.dump({
            "date": date,
            "papers": papers,
            "generated_at": datetime.now().isoformat(),
        }, f, ensure_ascii=False, indent=2)

The value reaches this function directly from a command-line argument:

python

if args.save_selected:
    date_str, papers_json = args.save_selected
    with open(papers_json, "r", encoding="utf-8") as f:
        data = json.load(f)
    # Support both a bare list and a {"date":..., "papers":[...]} wrapper
    papers = data if isinstance(data, list) else data.get("papers", [])
    save_selected_papers(date_str, papers)

Technical Analysis

The DATE command-line argument is used as part of an output path without validating that it is a calendar date or verifying that the resolved destination remains within processed_log.

A value containing traversal components, such as ../../target, produces a path outside the intended archive directory. An absolute date argument can also cause pathlib to discard the preceding PROCESSED_LOG_DIR. The script then opens the resulting path in write mode, truncating any existing writable file at that location.

The .json suffix is always appended, limiting the most direct overwrite targets to names ending in .json. Nevertheless, configuration, state, or application data stored in writable JSON files can be replaced.

Attack Path

1. An attacker obtains the ability to invoke the CLI, influence an automation co ...[truncated 1269 chars]

Remediation

View remediation

Remediation Suggestions

Validate the argument as an exact ISO calendar date before constructing the path:

python

from datetime import datetime

def validate_date(date: str) -> str:
    parsed = datetime.strptime(date, "%Y-%m-%d")
    normalized = parsed.strftime("%Y-%m-%d")
    if normalized != date:
        raise ValueError("DATE must use the exact YYYY-MM-DD format")
    return normalized

Then enforce containment after resolving the path:

python

def save_selected_papers(date: str, papers: list):
    date = validate_date(date)
    PROCESSED_LOG_DIR.mkdir(parents=True, exist_ok=True)

    base_dir = PROCESSED_LOG_DIR.resolve()
    log_file = (base_dir / f"{date}.json").resolve()

    if log_file.parent != base_dir:
        raise ValueError("Archive path escapes processed_log")

    with open(log_file, "w", encoding="utf-8") as f:
        json.dump(
            {
                "date": date,
                "papers": papers,
                "generated_at": datetime.now().isoformat(),
            },
            f,
            ensure_ascii=False,
            indent=2,
        )

Additional hardening measures:

• Reject date values containing path separators, traversal components, or unexpected characters.
• Run the Skill under a dedicated low-privilege account with limited filesystem write access.
• Use atomic file replacement to reduce corruption risks.
• Apply restrictive permissions to archive and state directories.
• Validate the structure and size of the supplied papers JSON before persisting it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documentation describes storing paper data and document registry artifacts locally and pushing generated content to Feishu Wiki, but it does not clearly warn users about persistence and external transmission. This can lead to unintended disclosure of research interests, generated summaries, document tokens/URLs, or other operational metadata to local disk and third-party services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation instructions use npx clawhub@latest, which pulls and executes the most recent published package version at install time without pinning. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users of the skill may execute unreviewed code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script prints the first 20 characters of the Feishu tenant access token to stdout, which constitutes partial secret disclosure. Even partial tokens can aid attackers through log scraping, correlation, or accidental exposure in CI/CD logs, terminals, or shared observability systems, especially because this script handles real production authentication material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'IMPORTANT: write in Chinese' mandates a specific language for the analysis. There is no opt-in, alternative language option, or documented reason that this skill must operate only in Chinese, so it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template instructs creating a Feishu wiki document and populating it with report content, which transmits data to an external service without any disclosure, consent step, or boundary on what may be shared. Even though the content is research-oriented, automatic exfiltration to third-party platforms can leak sensitive research direction, selected documents, internal summaries, or metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report title and field labels are written entirely in Chinese, which indicates the skill is designed to generate output in a specific language. The file does not provide any user opt-in, language selection, or documentation that this is a region-specific skill, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly says motivation and core_innovation are extracted in Chinese, and the selected results directory note also says it contains Chinese analysis. This is a natural-language policy concern because the skill mandates a specific language/locale without indicating user opt-in or configurability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file explicitly directs the agent to write selected paper data to data/selected_papers.json, which is a file-modifying operation. The template does not include any warning that the skill will create or overwrite local files, so users may not be aware that running it changes workspace data.

Content

No source excerpt is available for this finding.