Security audit

Researchclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its research-automation purpose, but it can run a long autonomous pipeline while skipping human approval gates and using external services or code execution modes.

Review before installing. Keep simulated mode and manual approval gates enabled for first runs, avoid --auto-approve when using sandbox or ssh_remote modes, do not provide confidential research topics or regulated data to external providers, and treat Docker-group changes, sudo installs, SSH keys, and generated experiment code as high-trust operations that should be reviewed manually.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description includes very broad triggers such as 'research paper', 'autonomous research', and 'paper generation', which are common phrases likely to match many unrelated user requests. This can cause the skill to activate in contexts where the user did not intend to run a powerful pipeline that installs software, validates live APIs, and launches long-running processes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The validation workflow explicitly includes an API connectivity test but does not clearly warn that this may send configuration-derived data or credentials-associated requests to external LLM providers. In a security-sensitive environment, silent outbound validation can expose metadata, trigger billing, or leak information about configured providers and endpoints.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The `auto_approve_gates` setting allows human approvals at stages 5, 9, and 20 to be skipped, enabling the pipeline to proceed autonomously through control points that were apparently intended as safety or quality checkpoints. In an autonomous research pipeline that can run experiments and potentially use remote execution modes, broad approval bypass increases the chance of unsafe actions, poor oversight, or unintended resource use.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly encourages running experiments in `sandbox` or `ssh_remote` modes and later describes code generation and experiment execution, but it does not clearly warn users that the pipeline may generate and execute untrusted AI-produced code. In a skill whose purpose is autonomous research and code execution, that omission materially increases the chance of unsafe local or remote execution, especially because users may treat the workflow as routine setup guidance.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The README states that the pipeline performs real citation retrieval, API calls, and literature searches, but it does not warn that prompts, research topics, metadata, and possibly configuration-derived information will be transmitted to external services. For a research automation skill, this can expose sensitive project details or regulated data if users assume the process is fully local.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document explicitly describes `ssh_remote` execution and `pipeline.auto_approve_gates` without adjacent safety guidance, approval requirements, or warnings about running code on remote infrastructure. In an autonomous research pipeline, combining remote execution with bypassed human gates materially increases the chance of unsafe or unintended actions being executed without review.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The document explicitly describes generating Python code, executing experiments, and producing artifacts, but it does not pair those actions with a clear safety warning about resource usage, filesystem changes, network access, or other system impacts. In a skill that automates a 23-stage pipeline, omission of such warnings can lead users or downstream agents to trigger impactful actions without informed consent.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: **Batch 2 — Experiment settings (ask with smart defaults):** 5. **Experiment mode**: `simulated` (no code execution, fastest), `sandbox` (local execution), or `ssh_remote` (GPU server). Default: `simulated` 6. **Auto-approve gates**: Skip human approval at stages 5, 9, 20? Default: `true` for first run 7. **Output directory**: Where to save artifacts. Default: `artifacts/` **Batch 3 — Optional advanced settings (offer but don't require):**
Confidence: 85% confidence
Finding: The skill recommends defaulting 'auto-approve gates' to true, which reduces human oversight in a 23-stage autonomous pipeline that can execute code, generate artifacts, and interact with external services. This increases the chance that risky or costly actions proceed without timely review, especially when combined with broad invocation triggers and installation/run workflows.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # --- Pipeline Settings --- pipeline: auto_approve_gates: ${AUTO_APPROVE} # true/false — skip human approval at stages 5, 9, 20 max_concurrent_stages: 1 output_dir: "${OUTPUT_DIR}"
Confidence: 87% confidence
Finding: This setting explicitly enables autonomous decision-making by allowing the system to skip human approval gates. In a 23-stage autonomous pipeline, removing human review can let flawed, unsafe, or unexpected actions continue unchecked, especially when combined with experiment execution or remote operation modes.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # --- Pipeline Settings --- pipeline: auto_approve_gates: ${AUTO_APPROVE} # true/false — skip human approval at stages 5, 9, 20 max_concurrent_stages: 1 output_dir: "${OUTPUT_DIR}"
Confidence: 87% confidence
Finding: This setting explicitly enables autonomous decision-making by allowing the system to skip human approval gates. In a 23-stage autonomous pipeline, removing human review can let flawed, unsafe, or unexpected actions continue unchecked, especially when combined with experiment execution or remote operation modes.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: | Field | Required | Type | Default | Description | |---|---|---|---|---| | `pipeline.auto_approve_gates` | No | bool | `false` | Skip human approval at gate stages (5, 9, 20) | | `pipeline.max_concurrent_stages` | No | int | `1` | Parallel stage execution (experimental) | | `pipeline.output_dir` | No | string | `artifacts/` | Base output directory |
Confidence: 90% confidence
Finding: `pipeline.auto_approve_gates` allows the system to skip human approval at key gate stages, reducing oversight over autonomous actions and outputs. In the context of a 23-stage autonomous research pipeline, this increases the risk that flawed, unsafe, or policy-violating decisions progress unchecked, especially when paired with execution capabilities.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # AutoResearchClaw Pipeline Stages Reference The pipeline consists of 23 stages organized into 8 phases. Three stages (5, 9, 20) are human-approval gates that pause for review unless `--auto-approve` is set. ## Phase 1: Topic and Problem Definition (Stages 1-2)
Confidence: 92% confidence
Finding: The presence of the explicit `--auto-approve` flag signals support for bypassing multiple human approval gates across the pipeline. In an agent skill that later generates and runs code, autonomous progression without review reduces accountability and increases the likelihood of unsafe execution or unreviewed outputs.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: |---|---|---|---| | 5 | RESEARCH_DIRECTION | Present proposed research direction for human approval | `direction_proposal.json` | **Gate behavior:** Pauses for human review. The user can approve, modify, or reject the direction. With `--auto-approve`, this is skipped. ## Phase 4: Hypothesis and Experiment Design (Stages 6-9)
Confidence: 90% confidence
Finding: The documentation makes clear that the stage-5 review can be skipped with `--auto-approve`, which undermines the intended control point for validating research direction. In this skill’s context, that matters because early autonomous decisions influence later generated code, experiment execution, and publication outputs.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # AutoResearchClaw Pipeline Stages Reference The pipeline consists of 23 stages organized into 8 phases. Three stages (5, 9, 20) are human-approval gates that pause for review unless `--auto-approve` is set. ## Phase 1: Topic and Problem Definition (Stages 1-2)
Confidence: 92% confidence
Finding: The presence of the explicit `--auto-approve` flag signals support for bypassing multiple human approval gates across the pipeline. In an agent skill that later generates and runs code, autonomous progression without review reduces accountability and increases the likelihood of unsafe execution or unreviewed outputs.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: |---|---|---|---| | 5 | RESEARCH_DIRECTION | Present proposed research direction for human approval | `direction_proposal.json` | **Gate behavior:** Pauses for human review. The user can approve, modify, or reject the direction. With `--auto-approve`, this is skipped. ## Phase 4: Hypothesis and Experiment Design (Stages 6-9)
Confidence: 90% confidence
Finding: The documentation makes clear that the stage-5 review can be skipped with `--auto-approve`, which undermines the intended control point for validating research direction. In this skill’s context, that matters because early autonomous decisions influence later generated code, experiment execution, and publication outputs.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: | `HTTP 401` or `AuthenticationError` | Invalid or expired API key | Check `config.yaml` → `llm.api_key` or the env var | | `HTTP 429` or `RateLimitError` | API rate limit hit | Wait 60 seconds and resume, or switch to a different model | | `Stage 10` failure | Code generation produced invalid Python | Check `artifacts/*/stage-10/experiment.py` for syntax errors | | `Docker` errors | Docker not running or permission denied | Run `docker info` to verify; may need `sudo usermod -aG docker $USER` | | `pdflatex` not found | LaTeX not installed | Install with `sudo apt-get install texlive-full` | | `ModuleNotFoundError` | Missing Python dependency | Run `pip3 install researchclaw[all]` | | `quality_score < threshold` | Quality gate too strict | Edit `config.yaml` → lower `quality.min_score` (default 2.0 is very strict) |
Confidence: 81% confidence
Finding: The troubleshooting guidance suggests a privileged command to modify Docker group membership (`sudo usermod -aG docker $USER`). Adding a user to the docker group is effectively privilege expansion on many systems because it can grant root-equivalent control over the host via Docker.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: | `HTTP 429` or `RateLimitError` | API rate limit hit | Wait 60 seconds and resume, or switch to a different model | | `Stage 10` failure | Code generation produced invalid Python | Check `artifacts/*/stage-10/experiment.py` for syntax errors | | `Docker` errors | Docker not running or permission denied | Run `docker info` to verify; may need `sudo usermod -aG docker $USER` | | `pdflatex` not found | LaTeX not installed | Install with `sudo apt-get install texlive-full` | | `ModuleNotFoundError` | Missing Python dependency | Run `pip3 install researchclaw[all]` | | `quality_score < threshold` | Quality gate too strict | Edit `config.yaml` → lower `quality.min_score` (default 2.0 is very strict) | | `MemoryError` or OOM | Insufficient RAM (needs 32GB+) | Use `simulated` experiment mode or reduce `max_concurrent_stages` |
Confidence: 70% confidence
Finding: The troubleshooting advice recommends `sudo apt-get install texlive-full`, a privileged package installation command. While installing LaTeX is not inherently dangerous, suggesting broad sudo-based installation from within a skill can normalize privileged changes and may lead to unnecessary system-wide modifications or large unintended downloads.

Static analysis

No suspicious patterns detected.