ClawHub
Back to skill

Security audit

ct-literature

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does public literature search as described, but it needs Review because it handles API keys while repeatedly framing itself as secret-free and includes reversible .env key obfuscation.

Install only if you are comfortable sending search topics to public bibliographic APIs. Prefer environment variables or a real secret manager for API keys, do not package .env files, and avoid relying on the reversible obfuscation as protection.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The module documentation states that the skill handles 'zero confidential data', but the code explicitly loads API keys from environment variables and local .env files. This is a real security documentation/integrity issue because it can mislead operators, reviewers, or packaging systems into treating the component as secret-free when it actually consumes credentials.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The inline comments acknowledge that the .env may contain PRIVATE API keys, directly contradicting the earlier claim of no confidential input. This inconsistency is dangerous because it normalizes insecure assumptions and may cause accidental publication or mishandling of bundled secrets.

Vague Triggers

Medium
Confidence
70% confidence
Finding
The README encourages users to issue plain-language requests in chat with 'no commands or manual needed,' which can make invocation boundaries too loose in an agent environment. Ambiguous triggering increases the chance the skill activates unintentionally and sends user-supplied queries to external public APIs, causing unintended network egress and possible disclosure of sensitive topics if the user misunderstands activation scope.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger examples include broad natural-language phrases such as 'help me search semaglutide literature' and similar everyday wording, which can cause accidental activation of the skill outside a clearly bounded user intent. In an agent environment, ambiguous activation can lead to unintended external retrieval, chaining into other skills, or execution of a workflow the user did not explicitly request, especially given the documented follow-on option to chain ct-pipeline.

Credential Access

High
Category
Privilege Escalation
Content
## v0.5.3 — 2026-08-08

- .env key 轻混淆（XOR+base64）防误打包明文扫描命中；http_utils.py 增加 `_deobfuscate` 向后兼容明文 .env；三平台同步发布。

## v0.5.2 — 2026-08-08
Confidence
93% confidence
Finding
.env

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.