Security audit

ArXiv Research

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: search arXiv and download selected PDFs, with normal dependency and file-write caveats.

Install the Python dependency in a virtual environment if possible, review the arxiv package source/version you install, and expect the download command to contact arXiv and save PDFs in your Downloads/arxiv folder.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party Python Dependency in the Root Skill## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:21-24`, and `arxiv_search.py:11-18` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}} ``` ```powershell # Install Python dependency pip install arxiv ``` ```python # Try to import arxiv try: import arxiv from arxiv import Client, Search except ImportError as e: print(f"Error: arxiv module not installed or import failed: {e}") print("Run: pip install arxiv") sys.exit(1) ``` ### Technical Analysis The root skill declares and recommends installation of the `arxiv` package without an exact version, integrity hash, lock file, or trusted package source. Consequently, the dependency resolved at installation time can differ from the version originally reviewed. Python package installation may execute package build or installation logic. The package is also imported by the skill, which executes its module-level initialization code. Therefore, compromise of the package publication account, package repository, distribution artifact, or a transitive dependency could introduce attacker-controlled code into the skill's execution path. This finding does not establish that the current `arxiv` package is malicious. The vulnerability is the mutable and unverifiable dependency resolution process. ### Attack Path 1. An attacker compromises the upstream package, its publisher account, its distribution channel, or a dependency resolved by it. 2. The attacker publishes a malicious or backdoored release under the package name used by the skill. 3. A user or agent installs the dependency using `pip install arxiv`, or the skill platform automatically resolves the unpinned `pip` requirement. 4. The package manager retrieves the attacker-contr ...[truncated 976 chars]
Remediation: ## Remediation Suggestions 1. Pin the dependency to an explicitly reviewed version, for example `arxiv==X.Y.Z`. 2. Generate and commit a dependency lock file containing all transitive dependencies. 3. Record cryptographic hashes for every approved distribution artifact and install with pip's `--require-hashes` option. 4. Prefer binary wheels from a controlled or explicitly trusted package repository where practical. 5. Review dependency updates before changing the pinned version or hashes. 6. Install and execute the skill in an isolated virtual environment under a non-privileged account. 7. Add automated software-composition analysis and artifact-integrity verification to the release process. 8. Replace the generic installation instruction with a reproducible command referencing the reviewed lock file and verified hashes.

T08 · Insecure Dependencies

Warning

Location: arxiv-osiris/SKILL.md:5
Finding: Unpinned Third-Party Python Dependency in the Nested arxiv-osiris Skill## Vulnerability Details **File Location**: `arxiv-osiris/SKILL.md:5`, `arxiv-osiris/SKILL.md:21-24`, and `arxiv-osiris/arxiv_search.py:11-18` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}} ``` ```powershell # Install Python dependency pip install arxiv ``` ```python # Try to import arxiv try: import arxiv from arxiv import Client, Search except ImportError as e: print(f"Error: arxiv module not installed or import failed: {e}") print("Run: pip install arxiv") sys.exit(1) ``` ### Technical Analysis The nested `arxiv-osiris` skill independently declares and recommends the unversioned `arxiv` dependency. It supplies no lock file, integrity hash, approved artifact, or restricted package source. Installation can therefore retrieve a dependency version that was not included in the audited project. Package installation and module import are code-execution boundaries. A compromised upstream release or transitive dependency could execute attacker-controlled code during installation or when `arxiv-osiris/arxiv_search.py` imports the package. This is a duplicate instance of the supply-chain weakness found in the root skill. There is no evidence in the reviewed files that the currently published dependency is malicious. ### Attack Path 1. An attacker gains control over an upstream package release, publisher account, distribution artifact, or transitive dependency. 2. A malicious release becomes the version selected by the unpinned dependency resolver. 3. A user follows the documented `pip install arxiv` command, or a skill manager installs the declared dependency automatically. 4. Because no version and hash are enforced, the malicious artifact is accepted. 5. Attacker-controlled code exec ...[truncated 710 chars]
Remediation: ## Remediation Suggestions 1. Replace the unversioned requirement with an exact, reviewed package version. 2. Commit a lock file that includes all transitive dependencies. 3. Pin approved distribution hashes and require hash verification during installation. 4. Configure installation to use a trusted package repository or an internally mirrored set of reviewed artifacts. 5. Perform dependency security and provenance checks before approving updates. 6. Run installation and execution inside an isolated virtual environment with least-privilege permissions. 7. Keep the nested skill's dependency policy synchronized with the root skill to prevent one copy from retaining weaker controls.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The download path creates a directory and saves a PDF fetched from arXiv, which is a file write combined with a network retrieval. Although the script prints the saved path afterward, there is no pre-action confirmation or explicit warning in the code comments/docstrings that running the download command will write into the user's Downloads directory.

Static analysis

No suspicious patterns detected.