Attention Research Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

The skill’s research workflow is coherent, but its install path and setup scripts create avoidable review-level risk through mutable remote code execution, automatic cron registration, and unsafe dependency installation.

Review before installing. Avoid the curl-from-master install path, prefer a pinned and verified release, inspect INSTALL/install.sh before running it, and be aware that --fresh currently registers recurring OpenClaw jobs and may modify Python packages. Configure Telegram or WhatsApp only for digests you are comfortable sending through those services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:117

Finding

Mutable Remote Repository Payload Is Downloaded and Immediately Executed

Content

View full analysis

Remediation

View remediation

.tar.gz ``` 2. Publish an expected SHA-256 digest through a separate trusted channel and verify it before extraction: ```bash echo " attention-research.tar.gz" | sha256sum -c - ``` 3. Prefer signed releases and verify the maintainer's cryptographic signature. 4. Download, verify, and extract as separate steps. Do not pipe network content directly into an extraction or execution pipeline. 5. Display the installer and planned filesystem changes before requesting authorization to execute it. 6. Ensure all installation examples in both `README.md` and `SKILL.md` use the same immutable and verified process. ]]>

T06 · System Persistence

Warning

• Location: INSTALL/install.sh:70

Finding

Fresh Installation Automatically Registers Persistent OpenClaw Cron Jobs Without Promised Approval

Content

View full analysis

"$CRON_JOBS_FILE" fi python3 -c "import json; d=json.load(open('$CRON_JOBS_FILE')); assert 'jobs' in d" 2>/dev/null || { echo "ERROR: cron jobs file invalid"; exit 1; } } ``` ```bash python3 - <

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: INSTALL/install.sh:23

Finding

Installer Uses an Unpinned PyPI Dependency and Bypasses System Package Protections

Content

View full analysis

/dev/null || { echo "Installing pyyaml..." python3 -m pip install pyyaml --break-system-packages --quiet } echo " Python: ok" echo " PyYAML: ok" } ``` ### Technical Analysis If the `yaml` module is unavailable, the installer retrieves and installs `pyyaml` from the ambient pip configuration without specifying an exact version or integrity hash. The `--break-system-packages` option intentionally bypasses Python's externally managed environment protection. This can modify an operating-system-managed Python environment and create dependency conflicts with other applications. The package name is legitimate, and the audited project contains no evidence that it intentionally requests a typosquatted dependency. The risk arises from unpinned network installation, trust in the user's ambient package index, and modification of a shared Python environment. ### Attack Path 1. The target environment does not already provide the `yaml` Python module. 2. The user runs the installer. 3. The installer invokes pip using the user's configured package index and trust settings. 4. A compromised index, poisoned mirror, altered package release, or unexpected future version supplies unsafe code. 5. Pip installs the package and executes its installation/build behavior. 6. The package gains the privileges of the user running the installer and can modify the selected Python environment. 7. `--break-system-packages` permits changes that the environment would otherwise reject. ### Impact Assessment A malicious dependency can execute code with the installer's user privileges and access user-readable files, credentials, and OpenClaw state. Even without a malicious package, t ...[truncated 277 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SCRIPTS/setup-cron.sh:50

Finding

Persisted Cron Commands Omit the Mandatory Executor Action

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIG/default-paths.yaml (reported line 8)May include surrounding context.

yaml

delivery:
  default_channel: "telegram"
  telegram:
    # Secrets live in CONFIG/.secrets.yaml (gitignored). Leave blank here.
    bot_token: ""
    chat_id: ""
  whatsapp:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · PROMPTS/CORE/system-prompt.md (reported line 85)May include surrounding context.

---

Digest Output Rules

Format per topic:

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The installer automatically runs python3 -m pip install pyyaml --break-system-packages --quiet when PyYAML is missing, modifying the user's Python environment without explicit consent. Using --break-system-packages increases risk by bypassing distro safeguards and can destabilize the system Python environment or interfere with other tools, especially on managed Linux installations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

These instructions hard-code an interpretive stance that public statements are not ground truth and are always audience management. This natural-language framing risks policy-relevant bias in analysis by removing neutral consideration of source claims and can systematically skew outputs.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · PROMPTS/CORE/system-prompt.md (reported line 148)May include surrounding context.

md

## What NOT to Do

- Raw headlines without interpretation
- Statements without asking "why now"
- "Experts say" without naming the institution and their interest
- Speculation without a stated confidence level
- Confirmation of existing beliefs without new evidence

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Allowing URL fetching and workspace file-path reads without any privacy, provenance, or access warning can cause the agent to ingest sensitive local files or untrusted remote content. In a prompt-driven system, this increases the chance of data exposure, prompt injection via fetched content, and accidental processing of material the user did not intend to disclose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Directing the agent to write PROMPTS/TOPICS/<topic-slug>.md without an explicit modification warning or approval step can lead to silent workspace changes. This is dangerous because it can overwrite or introduce prompt files that later influence agent behavior, creating persistence and supply-chain style risks within the workspace.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt materially expands the skill from a scheduled research/digest pipeline into a general topic-authoring tool that creates new prompt files. This broadens the agent’s effective authority and can enable unintended prompt generation or workflow changes outside the declared skill scope, increasing the risk of misuse and unsafe composition with other skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The template directs the agent to perform web searches and deliver digests via external messaging channels, which causes outbound network transmission and potential disclosure of research topics, results, or derived summaries to third parties. In a scheduled autonomous pipeline, this is more sensitive because transmission can occur without an interactive consent checkpoint, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly instructs delivery of the final digest through Telegram or WhatsApp, which are third-party messaging platforms, but provides no consent, classification, or data-handling guardrails. Because this skill aggregates potentially sensitive intelligence research across geopolitical, biotech, AI, and macro topics, automatic transmission can expose collected data, metadata, and operational patterns to external services or unintended recipients.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file says 'When a user says' and then lists broad natural-language examples like 'Add climate research' and 'I want to track biotech,' but it does not define whether these are exhaustive triggers, illustrative examples, or what nearby phrasing should not activate the skill. That ambiguity can cause unintended invocation from ordinary conversational requests about research topics.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The onboarding prompt instructs the agent to collect or rely on Telegram chat IDs or WhatsApp configuration even though the skill is presented as a research and digest pipeline, not a messaging-integration skill. This expands the skill into handling external delivery channels and user identifiers without clearly scoped justification, increasing the risk of unnecessary data collection or unintended outbound data flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Including WhatsApp and Telegram delivery-channel setup in a skill whose stated purpose is topic monitoring and digest generation creates a capability mismatch. That mismatch is dangerous because it can normalize requesting contact-routing data and enable exfiltration or dissemination of research outputs to external services beyond the user's expected scope.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · PROMPTS/TOPICS/bio-tech.md (reported line 67)May include surrounding context.

md

nder pressure

---

## Source Hierarchy

1. FDA decisions and filings — FDA.gov, approved labels, CRLs, advisory materials
2. Peer-reviewed medical journals (NEJM, Lancet, JCO, Blood) — clinical results with rigor
3. Earnings calls and SEC filings — 10-K, 10-Q, pipeline updates
4. Medical conference presentations (ASCO, AACR, ESMO) — validate with publication
5. Industry press (Stat News, FierceBiotech, BioCentury) — good on regulatory and deal signals

---

*Version 1.0.0 | Generated 2026-04-20*

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

bash

# git clone path
mkdir -p ~/.openclaw/skills
git clone https://github.com/riverho/attention-research.git ~/.openclaw/skills/attention-research
cd ~/.openclaw/skills/attention-research
bash INSTALL/install.sh --fresh

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README directs users to send research digests through Telegram or WhatsApp but does not warn that potentially sensitive research content, metadata, and recipient identifiers will be shared with third-party messaging platforms. In a scheduled intelligence-monitoring skill, this can lead to unintended disclosure of user interests, monitoring targets, and generated summaries outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs agents to schedule cron jobs and write topic news files/META.json state, but it does not clearly warn users that the skill will continue running in the background and persist data locally over time. For a twice-daily monitoring pipeline, hidden persistence and scheduled activity can create privacy, disk-residency, and operational risk if users do not realize the system remains active after setup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The documented workflow explicitly stores per-topic news files and updates META.json timestamps, creating an ongoing local history of searches, monitoring results, and operational state. In the context of intelligence-style topic tracking, that retained history can expose sensitive user interests or research outputs if the workstation, account, or backup system is later accessed by others.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

md

2. Read PROMPTS/TOPICS/<topic>.md as the live monitoring note for that topic
3. Freshness gate — skip if already updated this slot
4. Run the agent's web search tool — max 8 results, time range: last 24h
5. Write news file: topics/<topic>/news/<topic>-YYYY-MM-DD.md
6. Update META.json timestamps
7. On failure: meta_record_failure, retry once if allowed
8. After all topics: produce digest from news files, not from new search

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 143)May include surrounding context.

bash

# Install directly from GitHub with git
mkdir -p ~/.openclaw/skills
git clone https://github.com/riverho/attention-research.git \
  ~/.openclaw/skills/attention-research
cd ~/.openclaw/skills/attention-research

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The init_topic_meta function prints JSON to stdout but never writes it to the computed META.json path, even though it logs that the file was created. This causes missing metadata files to persist, which breaks the freshness/state-tracking workflow and can lead to topics being incorrectly treated as fresh or skipped, undermining the integrity of the scheduled research pipeline.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function's behavior and log message contradict reality by claiming a META.json file was created when no file is actually written. This is dangerous because operators and any downstream automation will trust false state, making failures harder to detect and potentially causing silent loss of coverage in a security- or intelligence-monitoring workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly describes persistent state management, installation scripts, and scheduled operation that will write under the user's home directory, yet it does not declare an explicit tool/permission scope. That mismatch can cause an agent or user to underestimate the write capabilities of the skill and approve execution without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises delivery via Telegram or WhatsApp but does not clearly warn, up front, that researched content may be transmitted to third-party messaging platforms. This creates a privacy and data-handling risk because potentially sensitive research outputs could leave the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The installation instructions direct the user to clone the repository into a persistent skills directory under the home folder and run an install script, establishing durable presence across sessions. In this skill's context, that persistence is expected functionality, but it still expands the trust boundary because the installed code and subsequent scheduled tasks can continue affecting the environment after the initial setup.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

clawhub install attention-research

# Or install directly from GitHub with git
mkdir -p ~/.openclaw/skills
git clone https://github.com/riverho/attention-research.git ~/.openclaw/skills/attention-research
cd ~/.openclaw/skills/attention-research
bash INSTALL/install.sh --fresh

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Hard-coding Hong Kong Time for scheduled execution without explaining why or making timezone selection explicit can cause jobs to run at unexpected local times. In a scheduled, networked workflow that writes files and sends messages, mistimed execution can lead to accidental disclosure, disruptive alerts, or missed/duplicate operational activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.