ClawHub
Back to skill

Security audit

Mli Paper Reading

Security checks for vulnerabilities and agentic risk

Overview

This paper-reading skill is purpose-aligned and transparent, with ordinary local note-generation behavior plus some privacy and convenience considerations.

Before installing, be comfortable with the skill writing HTML notes under ~/paper-notes, optionally installing pymupdf, starting a localhost preview server, opening your browser, and loading MathJax/Mermaid from a public CDN when the note is viewed. For sensitive papers, avoid opening the generated HTML online or adapt it to use local/offline assets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs the agent to automatically start a local HTTP server and open a browser as a required step, but does not require explicit user confirmation immediately before taking those side effects. Even though the server binds to 127.0.0.1, this still launches background processes and local applications unexpectedly, which can surprise users, expose local note contents to other local processes, and create persistence until manually stopped.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The generated HTML loads MathJax and Mermaid from external CDNs, but the skill does not prominently warn that opening the note will trigger network requests to third parties. In a paper-reading workflow, the paper title, timing, and access metadata may be sensitive research activity, so silent external fetches create a privacy leak and add supply-chain dependency on remote scripts.

Static analysis

No suspicious patterns detected.