ClawHub
Back to skill

Security audit

Phy Write Academic Report

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate academic report-writing skill, but it needs review because it recommends an unsafe remote installer and can automatically run broad repo-reading, file-writing, background-agent, and external citation-checking workflows.

Install only after reviewing the workflow. Run it on a copy of your research repo or a dedicated output directory, require confirmation before launching background agents or compiling, avoid the curl-to-shell installer, pin dependencies in a virtual environment, and disable or avoid citation API checks for confidential or unpublished bibliography data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/compilation-guide.md:30
Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:39
Finding

Python Dependency Installation Is Unpinned and Not Integrity-Verified

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description and code do not align in primary purpose. The declared skill is about producing large academic reports with a multi-wave authoring pipeline and parallel subagents. This code does none of that: it only analyzes .bib files, queries external scholarly databases, scores match confidence, flags red flags, and emits reports/exit codes. Citation checking could plausibly support an academic-writing workflow, but here it is the entire implemented behavior, not a minor supporting detail within the declared 3-wave thesis-writing system. The code also accesses undeclared external network resources (CrossRef, Semantic Scholar, OpenAlex) and lacks the key advertised capabilities of writing chapters, extracting repo data, parallelization, and LaTeX compilation/auditing. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a broad end-to-end thesis/dissertation writing pipeline with multiple waves and parallel subagents. The actual code chunk implements only one narrow support component: cross-reference auditing for LaTeX projects. While that aligns with part of the declared Wave 2 auditing claim, it does not perform the skill’s primary declared function of producing 40–100+ page academic reports, extracting repo data, coordinating parallel chapter-writing agents, or compiling LaTeX. The code also advertises a '--fix-prefix' usage mode in the docstring but does not implement it, further indicating the implementation is narrower than described. Therefore the declared description materially overstates the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk does not implement the declared primary purpose. Rather than orchestrating multi-wave academic report generation, it tests a citation-checking subsystem that evaluates whether bibliography entries are real, suspicious, or fabricated. The behavior centers on metadata validation (DOI, year, authors, title similarity) and external verification calls, which is materially different from writing thesis chapters or compiling LaTeX. While citation checking could be a supporting feature in an academic-writing tool, this specific chunk is narrowly focused on validating references and lacks the core declared capabilities, so the description does not accurately represent the code shown.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching and executing an external script in one step creates a supply-chain risk: if the hosting domain, TLS endpoint, or delivered content is compromised, arbitrary commands will run locally with the user's privileges. Because this is framed as a recommended Linux installation path, the skill materially increases the chance that users will execute unreviewed code.

Content

Scanner excerpt · references/compilation-guide.md (reported line 34)May include surrounding context.

bash
# Option A: pre-built binary
curl --proto '=https' --tlsv1.2 -fsSL https://drop-sh.fullyjustified.net | sh

# Option B: from source via cargo
cargo install tectonic

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh construct is the dangerous part of the command because it turns remote content into immediate shell input, bypassing normal review and increasing the blast radius of any compromise. In a how-to reference, this chaining pattern is particularly unsafe because it normalizes a hazardous operational practice rather than a one-off debugging step.

Content

Scanner excerpt · references/compilation-guide.md (reported line 34)May include surrounding context.

bash
# Option A: pre-built binary
curl --proto '=https' --tlsv1.2 -fsSL https://drop-sh.fullyjustified.net | sh

# Option B: from source via cargo
cargo install tectonic

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md
## What it does

Point it at your research repo. It launches parallel agents to extract data, write chapters simultaneously, compile LaTeX, and audit cross-references:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README advertises extracting data from a research repo, writing chapters, and compiling output, but does not clearly warn that these steps may create or modify files in the user's working tree. Users may invoke it expecting advisory help and instead cause substantial generated content or build artifacts to be written to their repository.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README says the skill can be invoked either with an explicit command or by broadly describing report needs, which creates an overly permissive trigger surface. In an agent environment, that can cause the skill to activate during ordinary academic-assistance requests and perform multi-step actions the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example phrase 'Write my FYP report based on this repo' is close to normal user speech and may match many benign requests for help drafting a report. Because the skill performs broad automated actions, this increases the risk of accidental invocation and unintended file modifications or costly agent execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding

The skill describes actions that inherently require reading repository files and making network requests for citation verification, but it declares no explicit tool scope or permissions boundaries. In an agent environment, that omission can cause overbroad access, unclear operator expectations, and accidental exposure of local research data or outbound requests to third-party services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states that every citation must be verified against at least two independent sources, but the implementation later accepts a single source if a DOI exists. This mismatch can cause users to overtrust the tool and include insufficiently verified references, undermining academic integrity and making fabricated or incorrect citations more likely to slip through.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow claims verification confirms title, authors, year, and venue across sources, but the code only uses title similarity to select matches and does not actually compare most metadata fields between sources. This can falsely mark the wrong paper as verified when titles are similar, especially for preprints, revised versions, or works with common names.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/citation-workflow.md (reported line 58)May include surrounding context.

Accept: application/x-bibtex

text

This returns publisher-authoritative BibTeX — always prefer this over hand-crafted entries.

### Step 4: Validate Claims

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/citation-workflow.md (reported line 114)May include surrounding context.

md
class CitationManager:
    """Search, verify, and retrieve academic citations from multiple APIs."""

    SEMANTIC_SCHOLAR_BASE = "https://api.semanticscholar.org/graph/v1"
    CROSSREF_BASE = "https://api.crossref.org/works"
    ARXIV_BASE = "http://export.arxiv.org/api/query"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/citation-workflow.md (reported line 682)May include surrounding context.

md
class CitationManager:
    """Search, verify, and retrieve academic citations from multiple APIs."""

    SEMANTIC_SCHOLAR_BASE = "https://api.semanticscholar.org/graph/v1"
    CROSSREF_BASE = "https://api.crossref.org/works"
    ARXIV_BASE = "http://export.arxiv.org/api/query"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/citation-workflow.md (reported line 115)May include surrounding context.

md
"""Search, verify, and retrieve academic citations from multiple APIs."""

    SEMANTIC_SCHOLAR_BASE = "https://api.semanticscholar.org/graph/v1"
    CROSSREF_BASE = "https://api.crossref.org/works"
    ARXIV_BASE = "http://export.arxiv.org/api/query"

    def __init__(self, email: Optional[str] = None, s2_api_key: Optional[str] = None):

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/citation-workflow.md (reported line 681)May include surrounding context.

md
"""Search, verify, and retrieve academic citations from multiple APIs."""

    SEMANTIC_SCHOLAR_BASE = "https://api.semanticscholar.org/graph/v1"
    CROSSREF_BASE = "https://api.crossref.org/works"
    ARXIV_BASE = "http://export.arxiv.org/api/query"

    def __init__(self, email: Optional[str] = None, s2_api_key: Optional[str] = None):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide instructs users to pipe a remotely fetched script directly into the shell, which removes any opportunity to inspect the script before execution and gives the remote server immediate code execution on the user's machine. In a documentation file for a build/report-writing skill, users are likely to copy-paste commands verbatim, making this especially risky even if the upstream project is legitimate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code transmits user-supplied citation data, including DOI values, to the external CrossRef API. In an academic-report skill, bibliography entries can contain unpublished paper titles, internal references, or sensitive research metadata, so sending them off-host creates a real confidentiality and data-governance risk even though the network use is part of the tool's intended function.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 242)May include surrounding context.

python
try:
        # If DOI is provided, verify directly
        if entry.doi:
            url = f"https://api.crossref.org/works/{entry.doi}"
            resp = requests.get(url, headers=HEADERS, timeout=10)
            if resp.status_code == 200:
                data = resp.json()["message"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This request sends citation titles derived from local .bib files to CrossRef search endpoints. Because titles themselves may reveal embargoed research topics, thesis contents, or proprietary project names, the external transmission is a legitimate security/privacy issue in this skill context, which recursively processes report directories and could expose many entries at once.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 272)May include surrounding context.

python
for search_title in search_titles:
            query = urllib.parse.quote(search_title)
            url = f"https://api.crossref.org/works?query.title={query}&rows=5"
            resp = requests.get(url, headers=HEADERS, timeout=15)
            if resp.status_code == 200:
                items = resp.json().get("message", {}).get("items", [])

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This code sends full citation titles to Semantic Scholar over the network for search. The behavior is expected for citation verification, but it still exposes potentially sensitive academic metadata to a third party and expands the disclosure surface beyond a single provider.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 307)May include surrounding context.

python
) -> Optional[dict]:
    """Search Semantic Scholar. Covers 200M+ papers with author disambiguation."""
    query = urllib.parse.quote(entry.title)
    url = f"https://api.semanticscholar.org/graph/v1/paper/search?query={query}&limit=3&fields=title,authors,year,externalIds"

    for attempt in range(2):
        try:

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This OpenAlex lookup transmits citation titles externally, contributing to cumulative metadata leakage across multiple public services. In the context of a thesis/dissertation automation skill, the tool may process large research repositories, increasing the volume and sensitivity of information disclosed.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 359)May include surrounding context.

python
for search_title in search_titles:
        try:
            query = urllib.parse.quote(search_title)
            url = f"https://api.openalex.org/works?filter=title.search:{query}&per_page=5"
            resp = requests.get(
                url,
                headers={**HEADERS, "Accept": "application/json"},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The integration tests call external citation-verification APIs and transmit bibliographic metadata from local test inputs to third-party services, but the script does not present a clear privacy/consent warning before doing so. In an academic-report skill, repository contents may include unpublished or sensitive references, so automatic outbound transmission can leak research topics, drafts, or confidential citation data during routine test execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.