Researchclaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:26 AM UTC
• Version: 0.1.0

Overview

The skill appears to support a real research-pipeline workflow, but it needs review because it handles API keys and runs long autonomous actions with approval gates skipped by default.

Review before installing. Prefer a dedicated virtual environment and pinned package or commit, use environment-variable names instead of raw API keys, do not paste secrets into chat, disable auto-approve for first runs, and avoid sandbox or SSH modes until you have reviewed the generated experiment code and config files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

``` 5. Verify the repository origin and commit before installation. 6. Install into a dedicated virtual environment rather than the global Python environment. 7. Display the resolved source, exact version, and requested extras before asking the user for installation approval. 8. Avoid `--force-reinstall` without a lock file and integrity checks. 9. Run the dependency with minimum filesystem, network, Docker, and SSH access appropriate for the selected experiment mode. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:103

Finding

Plaintext API-Key Exposure and Secret Backup Proliferation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad skill for operating and debugging the entire AutoResearchClaw research-paper pipeline. The supplied code does not perform setup, configuration, execution, troubleshooting, or paper generation. It merely inspects artifact folders to infer run state, appends status lines to a local notification log, and optionally emits OS notifications. While this could be a supporting monitoring component of such a system, the chunk's actual purpose is materially narrower than the declared skill description, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad skill for operating and debugging the AutoResearchClaw 23-stage research pipeline. The supplied code chunk does not perform any of those core functions; it only backs up a local config.yaml file before modification. While config backup could be a small supporting detail within a larger setup workflow, this chunk by itself materially differs from the declared primary purpose and lacks the described pipeline-related behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose presents a broad operational skill for managing and debugging the AutoResearchClaw research pipeline. However, the actual code chunk only implements a defensive PreToolUse hook that prevents deletion of pipeline artifacts. While this may be tangentially related to protecting research outputs, it does not itself automate pipeline setup, execution, monitoring, or troubleshooting. Its trigger context is delete attempts, which is materially different from the declared triggers around autonomous research and paper generation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

3. **API connectivity**: Test the LLM endpoint with a minimal request
4. **Docker health**: `docker info` (if experiment mode is `sandbox`)
5. **Disk space**: `df -h .` — warn if less than 10 GB free
6. **Write permissions**: `touch artifacts/.write-test && rm artifacts/.write-test`

Report results as a checklist with pass/fail for each item.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/config-template.yaml (reported line 31)May include surrounding context.

yaml

# ssh_remote:                     # Only needed for ssh_remote mode
  #   host: "gpu-server.example.com"
  #   user: "researcher"
  #   key_path: "~/.ssh/id_rsa"
  #   python_path: "/usr/bin/python3"

# --- Pipeline Settings ---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad, including generic terms like 'research paper' and 'paper generation', which can cause the skill to activate in ordinary conversations unrelated to this pipeline. Over-broad activation increases the chance the agent will propose or run high-impact setup, package installation, Docker, or pipeline commands in the wrong context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/README-CN.md (reported line 98)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 151)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 166)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 181)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 187)May include surrounding context.

1. Python 3.11+: Check python3 --version. If missing or too old, suggest pyenv install 3.11 or system package manager.
2. pip / uv: Check pip3 --version or uv --version. Suggest uv if not present (faster).
3. Docker: Check docker info. If Docker daemon is not running, tell the user honestly — this skill cannot start Docker for you on most systems.
4. LaTeX: Check pdflatex --version. If missing, suggest sudo apt-get install texlive-full (Linux) or brew install --cask mactex (macOS). Be honest: this is a large download (2-4 GB).
5. AutoResearchClaw: Check pip3 show researchclaw. If not installed:

   bash

   pip3 install researchclaw
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

**What this skill CANNOT do:**
- Start the Docker daemon (requires system-level access)
- Install LaTeX without sudo on Linux
- Fix network/firewall issues blocking API access
- Provide LLM API keys — the user must supply their own

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

**What this skill CANNOT do:**
- Start the Docker daemon (requires system-level access)
- Install LaTeX without sudo on Linux
- Fix network/firewall issues blocking API access
- Provide LLM API keys — the user must supply their own

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md

**What this skill CANNOT do:**
- Start the Docker daemon (requires system-level access)
- Install LaTeX without sudo on Linux
- Fix network/firewall issues blocking API access
- Provide LLM API keys — the user must supply their own

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration flow explicitly asks the user to provide an API key directly, but does not warn against pasting secrets into chat or recommend safer secret-handling methods. In an agent setting, this can lead to credential exposure in conversation history, logs, or generated config files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

Defaulting 'auto-approve gates' to true weakens meaningful human oversight over a multi-stage autonomous pipeline that can generate code, run experiments, and produce outputs without review at key checkpoints. In this context, reduced review increases the chance of unsafe execution, bad outputs, or unintended external actions.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

**Batch 2 — Experiment settings (ask with smart defaults):**

5. **Experiment mode**: `simulated` (no code execution, fastest), `sandbox` (local execution), or `ssh_remote` (GPU server). Default: `simulated`
6. **Auto-approve gates**: Skip human approval at stages 5, 9, 20? Default: `true` for first run
7. **Output directory**: Where to save artifacts. Default: `artifacts/`

**Batch 3 — Optional advanced settings (offer but don't require):**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

This duplicate finding targets the same unsafe behavior: unattended execution through '--auto-approve'. The danger is context-dependent but real here because the skill is designed to orchestrate a long-running autonomous workflow with potentially impactful actions.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

Start the pipeline:

bash

researchclaw run --topic "$ARGUMENTS" --config config.yaml --auto-approve 2>&1 | tee researchclaw-run.log

If $ARGUMENTS is empty, read the topic from config.yaml.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

This duplicate finding targets the same unsafe behavior: unattended execution through '--auto-approve'. The danger is context-dependent but real here because the skill is designed to orchestrate a long-running autonomous workflow with potentially impactful actions.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

Start the pipeline:

bash

researchclaw run --topic "$ARGUMENTS" --config config.yaml --auto-approve 2>&1 | tee researchclaw-run.log

If $ARGUMENTS is empty, read the topic from config.yaml.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

This duplicate finding again reflects unsafe unattended continuation via '--auto-approve' in resume mode. Automatic continuation after failure can mask recovery decisions that deserve human review.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

3. Determine the next stage name from the stage mapping above
4. Run:

   bash

   researchclaw run --config config.yaml --from-stage STAGE_NAME --output <run-dir> --auto-approve 2>&1 | tee researchclaw-resume.log
   

Known issue (upstream): The --from-stage flag may not work correctly in all versions. If resume fails, inform the user honestly and suggest:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

This duplicate finding again reflects unsafe unattended continuation via '--auto-approve' in resume mode. Automatic continuation after failure can mask recovery decisions that deserve human review.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

3. Determine the next stage name from the stage mapping above
4. Run:

   bash

   researchclaw run --config config.yaml --from-stage STAGE_NAME --output <run-dir> --auto-approve 2>&1 | tee researchclaw-resume.log
   

Known issue (upstream): The --from-stage flag may not work correctly in all versions. If resume fails, inform the user honestly and suggest:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

This setting enables autonomous decision-making by allowing the pipeline to bypass human checkpoints at stages 5, 9, and 20. In the context of a 23-stage autonomous system that can run experiments and generate research outputs, removing review gates reduces oversight and can permit unsafe or erroneous actions to continue unchecked.

Content

Scanner excerpt · assets/config-template.yaml (reported line 36)May include surrounding context.

yaml

# --- Pipeline Settings ---
pipeline:
  auto_approve_gates: ${AUTO_APPROVE}  # true/false — skip human approval at stages 5, 9, 20
  max_concurrent_stages: 1
  output_dir: "${OUTPUT_DIR}"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

This setting enables autonomous decision-making by allowing the pipeline to bypass human checkpoints at stages 5, 9, and 20. In the context of a 23-stage autonomous system that can run experiments and generate research outputs, removing review gates reduces oversight and can permit unsafe or erroneous actions to continue unchecked.

Content

Scanner excerpt · assets/config-template.yaml (reported line 36)May include surrounding context.

yaml

# --- Pipeline Settings ---
pipeline:
  auto_approve_gates: ${AUTO_APPROVE}  # true/false — skip human approval at stages 5, 9, 20
  max_concurrent_stages: 1
  output_dir: "${OUTPUT_DIR}"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The template exposes a configurable option to skip human approval at multiple pipeline stages, but provides no guardrails, environment restrictions, or warnings about when this is safe. In an autonomous research pipeline, this can let unreviewed actions proceed by default in user deployments, increasing the risk of unsafe execution, bad outputs, or unintended downstream actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to supply LLM API keys and describes network-dependent literature retrieval, but it does not clearly warn that prompts, research data, and credentials may be sent to third-party services. In a skill that automates a multi-stage pipeline, this omission can lead users to expose sensitive data or misuse credentials without understanding the privacy and cost implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.