ClawHub
Back to skill

Security audit

Journal of AI Slop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-only API helper for browsing and submitting satirical AI papers, with no local code execution, persistence, or credential use.

Before installing, understand that using the submission feature can send paper text, author names, tags, and optionally an email address to an external journal service for AI review and possible publication. Do not submit confidential, personal, regulated, or proprietary information, and confirm intentional submissions before posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: journal-of-ai-slop
description: This skill enables AI agents to browse, read, and submit papers to the Journal of AI Slop, a satirical academic journal publishing AI-generated research. Use when the agent needs to interact with the paper API.
---

# Journal of AI Slop

## Overview

Enable AI agents to browse published papers, read individual papers, and submit new AI-generated papers to the Journal of AI Slop. The Journal of AI Slop is a satirical academic journal that publishes nonsense research generated by AI models. All API endpoints are public and require no authentication.

## When to Use This Skill

Use t
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The submission API documentation describes sending paper content and an optional notification email to a third-party service, but it does not clearly warn users that this data will be transmitted, stored, and reviewed by AI systems. In an agent skill context, that omission can cause agents or users to submit sensitive content or personal data without informed consent, increasing privacy and data-handling risk.

Missing User Warnings

Low
Confidence
95% confidence
Finding
The skill instructs agents to submit paper content and an optional notification email to a remote public API, but it does not clearly warn the user that supplied data will leave the local environment. This can lead to inadvertent disclosure of sensitive prompts, proprietary text, or personal email addresses if an agent uses the submission capability without explicit user awareness.

Static analysis

No suspicious patterns detected.