ArXiv Research

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:16 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: search arXiv and download selected PDFs, with normal dependency and file-write caveats.

Install the Python dependency in a virtual environment if possible, review the arxiv package source/version you install, and expect the download command to contact arXiv and save PDFs in your Downloads/arxiv folder.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Python Dependency in the Root Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:21-24, and arxiv_search.py:11-18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}}

powershell

# Install Python dependency
pip install arxiv

python

# Try to import arxiv
try:
    import arxiv
    from arxiv import Client, Search
except ImportError as e:
    print(f"Error: arxiv module not installed or import failed: {e}")
    print("Run: pip install arxiv")
    sys.exit(1)

Technical Analysis

The root skill declares and recommends installation of the arxiv package without an exact version, integrity hash, lock file, or trusted package source. Consequently, the dependency resolved at installation time can differ from the version originally reviewed.

Python package installation may execute package build or installation logic. The package is also imported by the skill, which executes its module-level initialization code. Therefore, compromise of the package publication account, package repository, distribution artifact, or a transitive dependency could introduce attacker-controlled code into the skill's execution path.

This finding does not establish that the current arxiv package is malicious. The vulnerability is the mutable and unverifiable dependency resolution process.

Attack Path

1. An attacker compromises the upstream package, its publisher account, its distribution channel, or a dependency resolved by it.
2. The attacker publishes a malicious or backdoored release under the package name used by the skill.
3. A user or agent installs the dependency using pip install arxiv, or the skill platform automatically resolves the unpinned pip requirement.
4. The package manager retrieves the attacker-contr ...[truncated 976 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example arxiv==X.Y.Z.
2. Generate and commit a dependency lock file containing all transitive dependencies.
3. Record cryptographic hashes for every approved distribution artifact and install with pip's --require-hashes option.
4. Prefer binary wheels from a controlled or explicitly trusted package repository where practical.
5. Review dependency updates before changing the pinned version or hashes.
6. Install and execute the skill in an isolated virtual environment under a non-privileged account.
7. Add automated software-composition analysis and artifact-integrity verification to the release process.
8. Replace the generic installation instruction with a reproducible command referencing the reviewed lock file and verified hashes.

T08 · Insecure Dependencies

Warning

• Location: arxiv-osiris/SKILL.md:5

Finding

Unpinned Third-Party Python Dependency in the Nested arxiv-osiris Skill

Content

View full analysis

Vulnerability Details

File Location: arxiv-osiris/SKILL.md:5, arxiv-osiris/SKILL.md:21-24, and arxiv-osiris/arxiv_search.py:11-18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}}

powershell

# Install Python dependency
pip install arxiv

python

# Try to import arxiv
try:
    import arxiv
    from arxiv import Client, Search
except ImportError as e:
    print(f"Error: arxiv module not installed or import failed: {e}")
    print("Run: pip install arxiv")
    sys.exit(1)

Technical Analysis

The nested arxiv-osiris skill independently declares and recommends the unversioned arxiv dependency. It supplies no lock file, integrity hash, approved artifact, or restricted package source. Installation can therefore retrieve a dependency version that was not included in the audited project.

Package installation and module import are code-execution boundaries. A compromised upstream release or transitive dependency could execute attacker-controlled code during installation or when arxiv-osiris/arxiv_search.py imports the package.

This is a duplicate instance of the supply-chain weakness found in the root skill. There is no evidence in the reviewed files that the currently published dependency is malicious.

Attack Path

1. An attacker gains control over an upstream package release, publisher account, distribution artifact, or transitive dependency.
2. A malicious release becomes the version selected by the unpinned dependency resolver.
3. A user follows the documented pip install arxiv command, or a skill manager installs the declared dependency automatically.
4. Because no version and hash are enforced, the malicious artifact is accepted.
5. Attacker-controlled code exec ...[truncated 710 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned requirement with an exact, reviewed package version.
2. Commit a lock file that includes all transitive dependencies.
3. Pin approved distribution hashes and require hash verification during installation.
4. Configure installation to use a trusted package repository or an internally mirrored set of reviewed artifacts.
5. Perform dependency security and provenance checks before approving updates.
6. Run installation and execution inside an isolated virtual environment with least-privilege permissions.
7. Keep the nested skill's dependency policy synchronized with the root skill to prevent one copy from retaining weaker controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The download path creates a directory and saves a PDF fetched from arXiv, which is a file write combined with a network retrieval. Although the script prints the saved path afterward, there is no pre-action confirmation or explicit warning in the code comments/docstrings that running the download command will write into the user's Downloads directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.