Arxiv Osiris

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:25 PM UTC
• Version: 1.0.4

Overview

This skill is a straightforward arXiv search and PDF download helper with a disclosed third-party dependency and no hidden high-impact behavior found.

Install it in a virtual environment if possible, and consider pinning the arxiv package version before use. Expect it to contact arXiv and save requested PDFs locally; the documented PowerShell examples may need adjustment because the inspected package contains arxiv_search.py, not arxiv.ps1.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Dependency Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:18-22; dependency usage at arxiv_search.py:10-16
Vulnerability Type: Insecure third-party dependency management
Risk Level: Medium

The skill declares and instructs users to install the arxiv package without an exact version, cryptographic hashes, a lockfile, or a verified package source.

yaml

metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}}

powershell

# Install Python dependency
pip install arxiv

The installed dependency is imported and used directly by the skill:

python

# Try to import arxiv
try:
    import arxiv
    from arxiv import Client, Search
except ImportError as e:
    print(f"Error: arxiv module not installed or import failed: {e}")
    print("Run: pip install arxiv")
    sys.exit(1)

Technical Analysis

An unconstrained pip install arxiv resolves whichever package version the configured Python package index currently serves. The project does not provide an exact reviewed version, dependency lockfile, expected artifact hashes, or index restrictions. Consequently, the effective dependency code can change after this skill has been audited.

Python packages may execute installation or build logic during installation, and their imported modules execute with the privileges of the Python process. If the upstream package, one of its transitive dependencies, the configured package index, or dependency resolution process is compromised, attacker-controlled code could be installed and subsequently executed.

No evidence shows that the current arxiv dependency is malicious. The risk arises from the mutable and unverified supply-chain trust model.

Attack Path

1. An attacker compromises the upstream package, a transitive dependency, or a package source used by the environment.
2. The attacker publishes a malici ...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin arxiv to a specifically reviewed version rather than accepting any available release.
2. Place direct and transitive dependencies in a locked requirements file.
3. Record cryptographic hashes for every permitted distribution and install with pip install --require-hashes -r requirements.txt.
4. Prefer prebuilt, reviewed wheels and disable unnecessary source builds where operationally feasible.
5. Restrict installation to a trusted package index and explicitly configure the approved index URL.
6. Perform dependency vulnerability and provenance checks when updating the lockfile.
7. Install and run the skill in an isolated virtual environment under a non-privileged account.
8. Replace the documentation command with a reproducible command referencing the hash-locked requirements file.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.