ClawHub
Back to skill

Security audit

Paper Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent academic-paper workflow, but it asks users or agents to install and follow unpinned third-party companion skills from mutable sources.

Review and pin the companion skills before installation, avoid skills@latest for this workflow, and run it in a workspace that excludes secrets or unrelated private data. Keep original screenshots and source evidence, disclose meaningful edits, and review any generated archives before submission.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Companion Skills and Mutable Installation Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–26
Vulnerability Type: Supply-chain exposure through unpinned remote skills and installers
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Companion Skills Setup

Install these companion skills before relying on the full workflow:

- `academic-research-writer`
  - Curl `https://lobehub.com/skills/neversight-skills_feed-academic-research-writer/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `paper-validator`
  - Curl `https://lobehub.com/skills/minhuw-claude-writer-paper-validator/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `prompt-to-drawio`
  - Install with: `npx skills@latest add lzfxxx/prompt-to-drawio-skill`
  - After installation, read the installed `SKILL.md` and follow its instructions.

The same unsafe installation guidance is repeated in README.md, lines 45–62.

Technical Analysis

The skill directs users or agents to retrieve instructions from external URLs, install third-party skills, and follow the downloaded instructions. It does not pin those resources to immutable versions or commits and does not require checksum, signature, provenance, or content verification.

The command npx skills@latest introduces an additional mutable dependency: the code executed by the skills package can change whenever a new release becomes the latest version. The referenced prompt-to-drawio-skill is also not pinned to a reviewed commit.

Consequently, the effective behavior of this project is not limited to the content that was audited. It may inherit future behavior from mutable package releases, remote documents, marketp ...[truncated 1928 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to a reviewed exact version instead of using @latest.
  2. Pin each companion skill to an immutable release or full commit hash.
  3. Record and verify cryptographic checksums or trusted signatures before installation.
  4. Vendor reviewed companion SKILL.md files where licensing and maintenance policies permit.
  5. Require manual security review of downloaded instructions before allowing an agent to follow them.
  6. Do not directly pipe downloaded content into a shell or automatically treat remote instructions as trusted.
  7. Use a trusted allowlist for package publishers, repositories, domains, and expected artifact hashes.
  8. Install third-party skills in a sandbox with minimum filesystem, credential, process, and network access.
  9. Disable package lifecycle scripts where supported unless they have been explicitly reviewed.
  10. Maintain a lockfile or dependency manifest that records exact package versions, repository commits, hashes, and review dates.
  11. Apply the same corrected, pinned installation guidance to README.md, lines 45–62, so documentation does not reintroduce the unsafe workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
p LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
p LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
p LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx skills add ... without pinning a specific package version. This allows execution of whatever version is current at install time, which can change unexpectedly or be compromised upstream, creating a supply-chain risk in a security-sensitive agent tooling context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This installation command again uses npx skills add with an unpinned package version, so users may execute a different or malicious release than the author intended. Because npx fetches and runs packages, this is a practical supply-chain exposure rather than just a documentation quality issue.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
83% confidence
Finding

The README directs users to fetch an external skill from a marketplace URL and then follow the installed SKILL.md instructions. This expands the trust boundary to a third-party skill whose contents are not pinned, reviewed, or summarized here, increasing the risk of prompt-injection-style abuse or unsafe tool instructions in the agent ecosystem.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md
### academic-research-writer

Curl `https://lobehub.com/skills/neversight-skills_feed-academic-research-writer/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.

### paper-validator

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
83% confidence
Finding

This line similarly instructs users to retrieve another third-party skill and obey its installed instructions, effectively chaining trust to unverified external content. In the context of AI agent skills, that is more dangerous because downstream skill files can contain adversarial instructions, unsafe shell usage, or data-exfiltration guidance.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md
### paper-validator

Curl `https://lobehub.com/skills/minhuw-claude-writer-paper-validator/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.

### prompt-to-drawio

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
Install these companion skills before relying on the full workflow:

- `academic-research-writer`
  - Curl `https://lobehub.com/skills/neversight-skills_feed-academic-research-writer/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `paper-validator`
  - Curl `https://lobehub.com/skills/minhuw-claude-writer-paper-validator/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `prompt-to-drawio`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- `academic-research-writer`
  - Curl `https://lobehub.com/skills/neversight-skills_feed-academic-research-writer/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `paper-validator`
  - Curl `https://lobehub.com/skills/minhuw-claude-writer-paper-validator/skill.md`, then follow the instructions to set up LobeHub Skills Marketplace and install the skill. Once installed, read the `SKILL.md` file in the installed directory and follow its instructions to complete the task.
- `prompt-to-drawio`
  - Install with: `npx skills@latest add lzfxxx/prompt-to-drawio-skill`
  - After installation, read the installed `SKILL.md` and follow its instructions.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx skills@latest add ..., which fetches and executes the latest published package version at runtime without pinning or integrity verification. If the upstream package is compromised or a malicious update is published, this workflow could lead to arbitrary code execution on the user's system during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance explicitly prefers English UI and suggests anonymizing or replacing local-language text, which can alter evidentiary screenshots in a way that misrepresents the original artifact. In an academic paper workflow, screenshots are supposed to function as evidence, so changing language content without disclosure can undermine provenance, reproducibility, and reviewer trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file states that the workflow will 'Compress and package the final submission' and 'Archive the submission state,' which implies file creation or modification. The README does not include any user-facing warning that these steps may change files or create archives in the user's workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.