ClawHub
Back to skill

Security audit

多论文创新点对比

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches paper comparison, but it also instructs agents to run commands and write files without confirmation and includes a self-modification workflow.

Review before installing. Use only on a copy of your paper folder or a dedicated output directory, require confirmation before any command, package install, or file write, and remove or ignore the self-evolution section that writes diaries or proposes changes to SKILL.md.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The self-evolution section instructs the agent to append to diary files and propose changes to `SKILL.md`, which goes beyond the stated purpose of analyzing papers. A skill that can alter its own instructions or persist behavioral changes introduces prompt/policy drift and a durable modification channel that could be abused to weaken safeguards or embed unwanted behavior over time.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The instruction to execute Bash commands and Python scripts directly without user confirmation authorizes side-effectful operations by default. In a file-processing skill, this increases the risk of unintended writes, running untrusted local scripts, or acting on attacker-controlled paths/content without an explicit consent checkpoint.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The README explicitly states that generated files and extracted content will be written into the user's paper directory, but it does not clearly warn the user that the directory will be modified or suggest confirming that behavior first. In a skill that processes user research folders, silent writes can clutter datasets, overwrite expectations about folder immutability, and create privacy or workflow issues by depositing summaries and extracted text alongside source papers.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly directs file writes and script execution without user confirmation and without adequate warning. Because the skill reads from and writes into user-specified folders and invokes `python scripts/create_compare_docx.py`, an attacker could leverage path confusion, unsafe local scripts, or unexpected side effects to cause unauthorized modifications or execute risky actions under the guise of normal paper analysis.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.