ClawHub
Back to skill

Security audit

lit-review

Security checks for vulnerabilities and agentic risk

Overview

This literature-review skill is not malicious, but it needs Review because it sends research topics to external services, uses plaintext arXiv traffic, and can send a user-provided LLM API key to a configurable endpoint.

Install only if you are comfortable sending research queries to external academic APIs. Avoid confidential or unpublished topics unless the environment permits those disclosures. Do not enable LLM writing or provide an API key unless you trust and verify the configured endpoint; prefer HTTPS-only, allowlisted providers. Run it in a virtual environment and consider replacing the arXiv HTTP endpoint with HTTPS before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Warning
Location
main.py:228
Finding

Indirect Prompt Injection Through Untrusted Publication Metadata

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
main.py:225
Finding

User-Configurable LLM Endpoint Can Receive the Bearer Credential

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
lit_review.py:173
Finding

arXiv Queries and Responses Are Transmitted Over Plaintext HTTP

Content
View full analysis
List[Dict]: """Search arXiv for publications""" print("\nSearching arXiv...") url = "http://export.arxiv.org/api/query" params = { "search_query": f"all:{keywords}", "start": 0, "max_results": min(limit, 50), "sortBy": "relevance", "sortOrder": "descending" } try: import xml.etree.ElementTree as ET response = self.session.get(url, params=params, timeout=30) response.raise_for_status() root = ET.fromstring(response.text) ``` The primary entry point contains the same endpoint: ```python def search_arxiv(query: str, year_start: int, year_end: int, limit: int = 50) -> List[Dict]: """Call the arXiv API""" url = "http://export.arxiv.org/api/query" params = { "search_query": f"all:{query}", "start": 0, "max_results": limit, "sortBy": "relevance", "sortOrder": "descending" } try: resp = requests.get(url, params=params, timeout=10) ``` The standalone test also performs a plaintext request: ```python url = "http://export.arxiv.org/api/query" params = { "search_query": "cat:cs.CV AND deep learning", "start": 0, "max_results": 3 } response = requests.get(url, params=params, timeout=30) ``` ### Technical Analysis The arXiv request uses `http://` instead of TLS-protected `https://`. As a result, the query string and returned Atom feed have no transport confidentiality or integrity. An on-path attacker, malicious proxy, compromised network device, or hostile wireless network can observe the research query and alter the response ...[truncated 1535 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Dependency Versions Make Installations Non-Reproducible

Content
View full analysis
=2.28.0 scikit-learn>=1.0.0 numpy>=1.21.0 # Optional: advanced topic clustering sentence-transformers>=2.0.0 bertopic>=0.12.0 # Optional: DOCX output python-docx>=0.8.11 ``` The installation documentation similarly recommends unrestricted installations: ```bash pip install requests pip install scikit-learn numpy pip install sentence-transformers bertopic pip install python-docx ``` ### Technical Analysis Every dependency uses only a minimum version or no version constraint. pip may therefore install any later compatible release and a changing set of transitive dependencies. Two installations performed at different times can execute materially different third-party code. No typosquatted package, private package index, arbitrary URL dependency, or known malicious component was identified in the reviewed files. The risk arises from the lack of reproducible version and integrity controls rather than from evidence that the currently named packages are malicious. The optional machine-learning packages may introduce substantial transitive dependency trees. Without a lockfile and hashes, these components are difficult to audit consistently. ### Attack Path 1. A user follows the documented installation instructions. 2. pip resolves the latest versions allowed by the open-ended constraints. 3. A future compromised, malicious, or unexpectedly incompatible direct or transitive package version satisfies those constraints. 4. pip downloads and installs that version without comparison against a reviewed lockfile or artifact hash. 5. Package installation hooks or imported runtime code execute with the privileges of the user running the Ski ...[truncated 581 chars]
Remediation
View remediation
--hash=sha256: scikit-learn== --hash=sha256: numpy== --hash=sha256: ``` Actual versions and hashes should be generated from a trusted build process rather than copied from an unverified source. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (39)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 1)May include surrounding context.

md
---
name: lit-review
version: 1.1.0
description: "Conduct structured literature reviews with systematic search and synthesis"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listed trigger phrases are broad, natural-language terms such as '文献综述', '检索文献', and '研究热点' that can plausibly appear in ordinary conversation. In an agent platform, this increases the chance of unintended skill activation, causing the system to perform external searches and generate review content when the user did not explicitly intend to invoke this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all user-facing content in Chinese and does not indicate that Chinese is optional or that the skill is intentionally limited to Chinese-speaking users. The policy requires flagging language or locale constraints when a specific language is effectively forced without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains natural-language content exclusively in Chinese, including the title, section headers, and note, with no indication that the user opted into Chinese or that the skill is region-specific. Under the policy rule for language/locale, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description, user-facing prompts, help text, and examples are all hard-coded in Chinese, indicating the skill is intended to operate in a single language only. The file does not offer any language/locale selection or document a justified region-specific constraint, which matches the policy category for forced language without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill sends user-supplied research queries to the external Semantic Scholar API, which transmits potentially sensitive user interests or proprietary research topics to a third party. In this skill’s context, external search is core functionality, so the behavior is expected, but it still creates a privacy and data-governance risk if users assume local-only processing.

Content

Scanner excerpt · lit_review.py (reported line 135)May include surrounding context.

python
def search_semantic_scholar(self, keywords: str, years: int, limit: int = 50) -> List[Dict]:
        """从Semantic Scholar检索文献"""
        print("\n📚 正在检索 Semantic Scholar...")
        url = "https://api.semanticscholar.org/graph/v1/paper/search"
        current_year = datetime.now().year
        
        params = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill also sends user search terms to the external CrossRef API, creating the same third-party data exposure risk for potentially confidential research topics. This is less dangerous than arbitrary exfiltration because it is directly tied to the stated literature-search purpose, but it remains a real external transmission issue.

Content

Scanner excerpt · lit_review.py (reported line 238)May include surrounding context.

python
def search_crossref(self, keywords: str, years: int, limit: int = 30) -> List[Dict]:
        """从CrossRef检索文献"""
        print("\n📑 正在检索 CrossRef...")
        url = "https://api.crossref.org/works"
        current_year = datetime.now().year
        
        params = {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User-facing descriptions, status messages, warnings, and generated review prompts are written in Chinese throughout the file, and the generated content is also instructed in Chinese. There is no option for the user to select another language or locale, which can violate language-choice policy for general-purpose skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 6)May include surrounding context.

json
"max_papers": 50,
    "use_llm_for_writing": False,
    "llm_model": "deepseek-chat",
    "llm_api_base": "https://api.deepseek.com/v1",
    "output_format": "markdown",
    "human_review_papers": False
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lit_review.py (reported line 46)May include surrounding context.

python
"max_papers": 50,
    "use_llm_for_writing": False,
    "llm_model": "deepseek-chat",
    "llm_api_base": "https://api.deepseek.com/v1",
    "output_format": "markdown",
    "human_review_papers": False
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 29)May include surrounding context.

python
"max_papers": 50,
    "use_llm_for_writing": False,
    "llm_model": "deepseek-chat",
    "llm_api_base": "https://api.deepseek.com/v1",
    "output_format": "markdown",
    "human_review_papers": False
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 37)May include surrounding context.

python
# ------------------- 检索模块 -------------------
def search_semantic_scholar(query: str, year_start: int, year_end: int, limit: int = 100) -> List[Dict]:
    """调用Semantic Scholar API"""
    url = "https://api.semanticscholar.org/graph/v1/paper/search"
    params = {
        "query": query,
        "year": f"{year_start}-{year_end}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 87)May include surrounding context.

python
def search_crossref(query: str, year_start: int, year_end: int, limit: int = 50) -> List[Dict]:
    """调用CrossRef API"""
    url = "https://api.crossref.org/works"
    params = {
        "query": query,
        "filter": f"from-pub-date:{year_start},until-pub-date:{year_end}",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring says the function performs clustering based on title/abstract keyword co-occurrence using KMeans, implying an actual analytical clustering step. In reality, the implementation just constructs two hard-coded topic buckets from list slices and never computes keywords, vectors, or KMeans clusters, which is a direct contradiction rather than mere incompleteness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

When LLM writing is enabled, the code sends the user topic plus retrieved paper titles/abstract snippets to a third-party API without any explicit disclosure or confirmation at runtime. In this skill context, the content may include sensitive research topics or unpublished/internal query intent, creating an avoidable data exposure risk to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill transmits user topic and summarized paper metadata to an external LLM endpoint. In context, this creates a real outbound data-sharing channel to a third party, which is security-relevant because research interests and retrieved text may be sensitive and the destination is configurable.

Content

Scanner excerpt · main.py (reported line 249)May include surrounding context.

python
}
    api_base = config.get("llm_api_base")
    try:
        resp = requests.post(f"{api_base}/chat/completions", headers=headers, json=data, timeout=60)
        resp.raise_for_status()
        result = resp.json()
        content = result["choices"][0]["message"]["content"]

Tainted flow: 'data' from requests.get (line 97, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · main.py (reported line 249)May include surrounding context.

python
}
    api_base = config.get("llm_api_base")
    try:
        resp = requests.post(f"{api_base}/chat/completions", headers=headers, json=data, timeout=60)
        resp.raise_for_status()
        result = resp.json()
        content = result["choices"][0]["message"]["content"]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The package description is written entirely in Chinese and describes the skill's behavior without indicating that language is optional or user-selectable. Under the language/locale policy, this can be interpreted as a default language constraint without explicit user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation conditions are very broad and match common requests like searching papers, writing reviews, or summarizing trends. This can cause the skill to trigger in situations where the user did not explicitly intend external retrieval or synthesis, increasing the chance of unexpected network access and unintended handling of user research topics.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill explicitly transmits user query data to Semantic Scholar over the network as part of its normal operation. While expected for the feature, this is still a real external data transmission risk because research topics may be sensitive and the skill does not indicate any consent, minimization, or privacy safeguards.

Content

Scanner excerpt · skill.md (reported line 28)May include surrounding context.

md
- 若用户未提供，使用配置文件中的默认值（默认5年�?0篇）
- 自动生成英文同义词和字段变体

### 2. 文献检�?- 并发调用以下API（优先使用Semantic Scholar，返回结果快且丰富）�?  - **Semantic Scholar API**：`https://api.semanticscholar.org/graph/v1/paper/search`
  - **arXiv API**：`http://export.arxiv.org/api/query`
  - **CrossRef API**：`https://api.crossref.org/works`
- 检索参数：关键词、出版年份范围、按相关性排序、每页最�?00�?- 合并去重（基于DOI或标题相似度�?

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states it will send user-supplied topics to external academic APIs and may optionally submit generated drafts and paper abstracts to an LLM endpoint, but it does not present a clear user-facing privacy notice or consent step. Users may unknowingly transmit sensitive research interests, unpublished ideas, or confidential problem statements to third parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill sends user-derived search parameters to CrossRef, creating another third-party disclosure channel. In the absence of user notice and explicit consent, this can expose confidential topics or internal research directions to external services.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

md
### 2. 文献检�?- 并发调用以下API（优先使用Semantic Scholar，返回结果快且丰富）�?  - **Semantic Scholar API**：`https://api.semanticscholar.org/graph/v1/paper/search`
  - **arXiv API**：`http://export.arxiv.org/api/query`
  - **CrossRef API**：`https://api.crossref.org/works`
- 检索参数：关键词、出版年份范围、按相关性排序、每页最�?00�?- 合并去重（基于DOI或标题相似度�?
### 3. 相关性筛选（本地�?- 对摘要和标题进行关键词匹配或TF-IDF向量化，计算与用户关键词的余弦相似度
- 按相似度降序排序，结合引用数加权，保留前 `max_papers` �?- �?`human_review_papers = true`，则生成候选列表并询问用户是否采纳或手动剔�?

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The optional LLM-writing mode can send locally generated drafts and paper abstracts to the DeepSeek API, which may include sensitive user topics, proprietary summaries, or copyrighted content excerpts. Compared with search APIs, this is more dangerous because it can transmit larger bodies of derived content to a third-party model provider without documented consent or handling guarantees.

Content

Scanner excerpt · skill.md (reported line 68)May include surrounding context.

md
|------|------|--------|------|
| use_llm_for_writing | bool | false | 是否使用大模型润色综�?|
| llm_model | str | deepseek-chat | 大模型名�?|
| llm_api_base | str | https://api.deepseek.com/v1 | 大模型API端点 |
| llm_api_key | str | - | 大模型API密钥（需配置�?|
| output_format | str | markdown | 输出格式（markdown/docx/txt�?|
| human_review_papers | bool | false | 是否请求用户确认文献列表 |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script prints status and result messages only in Chinese string literals, which imposes a specific language on users without opt-in. This matches the policy category for language or locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is entirely written as a generated skill/document output in Chinese, and it does not indicate that the user can choose another language or opt in to Chinese. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.