Arxiv Daily Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but its setup and helper scripts can make persistent system changes and handle network data in unsafe ways that users should review before installing.

Review and fix the cron setup before installing: preserve existing crontab entries, run under an unprivileged account, and add an uninstall command. Use HTTPS for arXiv, remove `xmllint --noent` or the alternate shell fetcher, and store reports in a private directory rather than predictable `/tmp` paths. Only configure the Feishu webhook for a destination where sending paper-report previews is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:49
• Finding: Destructive replacement of the user's existing crontab<![CDATA[ ## Vulnerability Details **File Location**: `README.md:49-54` **Vulnerability Type**: Unsafe scheduled-task configuration **Risk Level**: High ### Vulnerable Code ```bash # View the current cron configuration crontab -l # Manually add the scheduled task: echo "0 9 * * 1-5 /home/admin/.openclaw/workspace/skills/arxiv-daily-skill/cron_run.sh" | crontab - ``` ### Technical Analysis The documented `crontab -` command does not append a new entry. It replaces the executing user's complete crontab with the single line received through standard input. A weekday scheduled task is consistent with the Skill's declared daily-paper-delivery functionality. Therefore, scheduling itself is not an undeclared backdoor. However, deleting unrelated scheduled entries exceeds the minimum system modification necessary to provide that functionality. The hardcoded `/home/admin/...` path also makes the instruction account-specific and may encourage users to run it under an unnecessarily privileged account. ### Attack Path 1. A user follows the installation instructions. 2. The shell sends only the Skill's cron entry to `crontab -`. 3. Cron replaces the user's current configuration rather than merging the entry. 4. Existing backup, certificate-renewal, monitoring, synchronization, or maintenance tasks are removed. 5. The Skill remains scheduled to run every weekday while unrelated jobs no longer execute. This does not directly grant an external attacker additional privileges, but it causes persistent and potentially destructive system configuration changes. ### Impact Assessment The impact is limited to the account that executes the command. All cron jobs belonging to that account can be deleted. If the command is run by an administrative account, interruption may affect system-wide operational tasks performed by that account. The scheduled Skill subsequently operates with all privileges of the affected user. No evidence shows that the project attempts to obtain r ...[truncated 61 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Preserve existing entries, prevent duplicate installation, and require the user to review the resulting configuration: ```bash CRON_ENTRY="0 9 * * 1-5 /absolute/path/to/arxiv-daily-skill/cron_run.sh" ( crontab -l 2>/dev/null || true printf '%s\n' "$CRON_ENTRY" ) | awk '!seen[$0]++' | crontab - ``` Additional hardening measures: 1. Replace the hardcoded account path with an installer-resolved absolute path. 2. Clearly state that the job should be installed under an unprivileged user. 3. Display the proposed cron entry and obtain explicit approval before installation. 4. Provide an uninstall command that removes only the Skill's entry. 5. Consider using a uniquely marked managed block so updates do not affect unrelated jobs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.sh:20
• Finding: MITM-assisted XML external entity expansion in the alternate shell fetcher<![CDATA[ ## Vulnerability Details **File Location**: `index.sh:20-22` **Vulnerability Type**: XML external entity expansion over unauthenticated transport **Risk Level**: High ### Vulnerable Code ```bash curl -s "http://export.arxiv.org/api/query?search_query=${query}&sortBy=submittedDate&sortOrder=descending&max_results=${max_results}" \ | xmllint --noent - 2>/dev/null \ || curl -s "http://export.arxiv.org/api/query?search_query=${query}&sortBy=submittedDate&sortOrder=descending&max_results=${max_results}" ``` ### Technical Analysis The script downloads XML over plaintext HTTP and passes it to `xmllint --noent`. The `--noent` option substitutes entity references and is unsafe for untrusted XML because a document can define external entities that reference local files or other resources. Because HTTP does not authenticate the server response, an attacker capable of intercepting or modifying network traffic can replace the arXiv response with malicious XML. A representative payload is: ```xml <?xml version="1.0"?> <!DOCTYPE feed [ <!ENTITY disclosure SYSTEM "file:///etc/passwd"> ]> <feed> <title>&disclosure;</title> </feed> ``` If the installed libxml configuration permits the relevant external resource resolution, `xmllint --noent` expands the entity and emits the referenced content. Entity expansion can also consume excessive resources, and some configurations may permit requests to internal network services. ### Attack Path 1. The user executes `index.sh`. 2. The script requests the arXiv API through plaintext HTTP. 3. An attacker on the network path intercepts or alters the response. 4. The attacker supplies XML containing a `DOCTYPE` and an external entity. 5. `xmllint --noent` parses and expands the attacker-defined entity. 6. Readable local file content may be included in standard output, terminal capture, automation logs, or downstream processing. The attacker must be able to modify the network response, such as through a hostile acce ...[truncated 812 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use HTTPS exclusively: ```bash curl --fail --silent --show-error \ "https://export.arxiv.org/api/query?search_query=${query}&sortBy=submittedDate&sortOrder=descending&max_results=${max_results}" ``` 2. Remove `--noent`. Entity substitution is unnecessary for the declared feed-processing task: ```bash curl --fail --silent --show-error "$url" | xmllint --nonet - ``` 3. Configure XML parsing to reject `DOCTYPE` declarations and external entities. 4. Enable `--nonet` so the parser cannot retrieve external network resources. 5. Apply response-size and timeout limits to reduce denial-of-service exposure. 6. Prefer the Python `ElementTree` implementation already used by the main script, while still enforcing HTTPS and bounded response sizes. 7. Remove `index.sh` if it is obsolete, preventing users from invoking an insecure alternate path. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_arxiv.py:13
• Finding: Paper-feed integrity can be compromised through plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `fetch_arxiv.py:13-53` **Vulnerability Type**: Unauthenticated transport for externally forwarded content **Risk Level**: Medium ### Vulnerable Code ```python ARXIV_API = "http://export.arxiv.org/api/query" ``` ```python def fetch_papers(query, max_results=5): url = f"{ARXIV_API}?search_query={query.replace(' ', '+')}&sortBy=submittedDate&sortOrder=descending&max_results={max_results}" try: with urllib.request.urlopen(url, timeout=10) as response: return response.read().decode('utf-8') except Exception as e: print(f"❌ 获取失败：{e}") return None ``` The retrieved fields are formatted into a report, and `cron_run.sh:86-88` sends a report preview to the configured Feishu webhook: ```bash RESPONSE=$(curl -s -X POST "$FEISHU_WEBHOOK" \ -H "Content-Type: application/json" \ -d "$MESSAGE") ``` ### Technical Analysis The arXiv API response is fetched through plaintext HTTP. The connection therefore provides no cryptographic server authentication or response-integrity protection. An on-path attacker can alter Atom fields such as titles, authors, summaries, identifiers, and links. The main script parses those values as trusted feed data and incorporates them into the generated report. During scheduled operation, part of that report is forwarded to the configured Feishu group. This is an integrity issue rather than remote code execution: the retrieved content is parsed and displayed, not executed as Python or shell code. ### Attack Path 1. The scheduled or manual workflow requests the arXiv API over HTTP. 2. An on-path attacker intercepts the connection. 3. The attacker returns a syntactically valid but modified Atom feed. 4. `parse_arxiv_xml()` accepts the forged metadata. 5. `format_output()` places the attacker-controlled content in the report. 6. `cron_run.sh` embeds the report preview in a Feishu message. 7. Recipients receive misleading or attacker-c ...[truncated 630 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the endpoint with HTTPS: ```python ARXIV_API = "https://export.arxiv.org/api/query" ``` 2. Construct the query using `urllib.parse.urlencode()` rather than manual space replacement. 3. Limit the maximum accepted response size before parsing. 4. Validate the response content type and reject unexpected formats. 5. Validate parsed arXiv identifiers against a strict expected pattern. 6. Generate displayed links from validated identifiers rather than relying on arbitrary feed URLs. 7. Handle redirects conservatively and ensure the final URL remains on an approved HTTPS arXiv host. 8. Apply output-length limits and robust JSON serialization before forwarding content to Feishu. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: cron_run.sh:8
• Finding: Predictable files in a shared temporary directory permit symlink-based overwrite<![CDATA[ ## Vulnerability Details **File Location**: `cron_run.sh:8-33` **Vulnerability Type**: Unsafe predictable temporary files **Risk Level**: Medium ### Vulnerable Code ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" OUTPUT_FILE="/tmp/arxiv_daily_$(date +%Y%m%d).md" AFFILIATIONS_DB="$SCRIPT_DIR/affiliations_db.json" ``` ```bash cd "$SCRIPT_DIR" python3 fetch_arxiv.py > "$OUTPUT_FILE" 2>&1 ``` ```bash PREVIEW_FILE="/tmp/arxiv_preview_$(date +%Y%m%d).txt" head -30 "$OUTPUT_FILE" > "$PREVIEW_FILE" ``` The manual launcher contains the same output pattern at `run.sh:10-17`: ```bash OUTPUT_FILE="/tmp/arxiv_daily_$(date +%Y%m%d).md" python3 "$SCRIPT_DIR/fetch_arxiv.py" > "$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis The scripts create report files directly under the shared `/tmp` directory using names that can be predicted from the current date. Shell output redirection opens the target path and generally follows symbolic links. A local attacker may pre-create the expected path as a symbolic link to another file. When the scheduled task runs, redirection can truncate and overwrite that target with report data, provided the executing account has permission to write the target and operating-system symlink protections do not block the operation. Even when symlink protections prevent exploitation, pre-created files can cause ownership conflicts or denial of service. ### Attack Path 1. A local attacker determines the date of the next scheduled execution. 2. The attacker predicts paths such as `/tmp/arxiv_daily_20260916.md`. 3. The attacker creates a symbolic link at the predicted path pointing to a file writable by the cron account. 4. The scheduled process opens the predictable pathname through shell redirection. 5. If platform protections permit the operation, the linked target is truncated and replaced with generated report output. 6. The same technique can target the predictable preview file. Exploitation requires local filesyst ...[truncated 691 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a private temporary directory using `mktemp`, apply restrictive permissions, and remove it reliably: ```bash TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/arxiv-daily.XXXXXX")" chmod 700 "$TMP_DIR" trap 'rm -rf "$TMP_DIR"' EXIT HUP INT TERM OUTPUT_FILE="$TMP_DIR/report.md" PREVIEW_FILE="$TMP_DIR/preview.txt" python3 "$SCRIPT_DIR/fetch_arxiv.py" > "$OUTPUT_FILE" 2>&1 head -30 "$OUTPUT_FILE" > "$PREVIEW_FILE" ``` If reports must persist after execution: 1. Store them in a dedicated directory owned by the Skill's unprivileged user. 2. Set the directory mode to `0700` or another appropriately restrictive mode. 3. Create final files atomically and refuse to overwrite symbolic links. 4. Use a random temporary filename and then move the completed report to its destination. 5. Avoid running the cron task as root or another privileged service account. 6. Apply the same correction to both `cron_run.sh` and `run.sh`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 声明描述了一个每日收集 arXiv 特定方向论文并附带机构信息、再进行飞书推送的技能。实际提供的代码片段主要负责调度与推送：执行另一个脚本 fetch_arxiv.py、处理输出文件、并通过 curl 向飞书 webhook 发消息。由于声明中的权限为空，但代码实际存在明确的网络发送行为和配置读取行为，属于未声明能力。另一个重要点是，这个代码片段自身并不能证明其确实完成了“LLM/RAG/Agent 方向筛选”和“机构信息补充”，这些核心功能都在外部脚本中，当前片段只能确认推送包装逻辑。因此描述与所给代码行为并不完全一致，存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个自动化论文监控/推送技能：定期收集特定方向 arXiv 论文、补充机构信息并发送到飞书。实际代码仅对用户提供的单篇 arXiv 论文 ID 执行页面抓取，解析基础元数据，并拼装一个待补全的“深度分析”报告模板后打印输出。它没有体现自动化收集、主题范围过滤、批量处理、定时任务、消息推送或飞书集成。虽然两者都与 arXiv 论文和机构信息有关，但核心功能和运行方式明显不同，因此属于实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 描述与代码部分一致：代码确实会搜集 arXiv 论文并补充机构信息。但存在几个实质性偏差。首先，声明中的“飞书推送”在代码中没有实现；输出仅为控制台打印的 Markdown 文本，没有任何飞书 API、Webhook 或消息发送逻辑。其次，论文抓取范围不止 LLM/RAG/Agent，还包含 Transformer、Harness、Reasoning，超出了声明的主题范围。再次，代码除了调用 arXiv API 外，还会访问 arXiv 论文 HTML 页面以推断机构，并把结果写入本地 affiliations_db.json 持久化保存，这属于描述中未体现的额外行为。综合看，整体目的接近，但描述未准确覆盖关键行为且包含未实现能力，因此应判定为 mismatch。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 代码的核心行为与“搜集 arXiv 论文”部分基本一致：它确实向 arXiv API 发起与 LLM/RAG/Agent 等相关的查询并获取结果。但描述中的几个关键能力在代码中没有体现：1）没有解析作者机构信息；2）没有任何飞书 webhook 或消息发送逻辑；3）Triggers 为空，代码本身也没有定时调度机制，因此“每日自动”未被实现；4）parse_entry 函数甚至未被使用，整体只是打印抓取到的 XML/响应内容，而非完整的精选整理与推送。因此描述对功能有明显夸大，属于不准确表述。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 声明的核心能力包括：按日自动搜集特定方向 arXiv 论文、附带机构信息、并通过飞书推送。实际代码片段只展示了一个本地执行入口：调用 fetch_arxiv.py 生成报告文件并在命令行预览前 20 行。片段中没有任何飞书 API、Webhook、消息发送逻辑；也没有可见的机构信息处理逻辑；触发器为空且脚本本身未体现“每日自动”调度。虽然抓取 arXiv 论文这一部分与声明部分一致，但声明中的关键交付方式（飞书推送）和内容增强（机构信息）在该代码片段中都未得到体现，因此描述与行为存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: 声明描述的是一个完整自动化流程：定期从 arXiv 搜集特定方向论文、附带机构信息、并发送到飞书。实际代码仅实现其中一个子功能——对指定 arXiv ID 的页面进行机构信息提取，并在本地打印测试结果。它没有展示定时触发、论文抓取/筛选、消息推送等核心能力。虽然“带机构信息”这一点与代码部分一致，但整体主用途与声明相比明显不完整，且更像开发/测试辅助脚本，因此属于描述与实际行为不匹配。

External Script Fetching

High

• Category: Supply Chain

Content

)
    
    # 发送飞书消息
    RESPONSE=$(curl -s -X POST "$FEISHU_WEBHOOK" \
        -H "Content-Type: application/json" \
        -d "$MESSAGE")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This markdown file states that the skill collects papers, structures a report, and pushes it via Feishu, which is a network action transmitting generated content to an external service. It also later describes saving full reports to local files, but the README does not clearly warn users about these privacy/system-impacting behaviors up front.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to install a cron job that executes the skill every weekday, which can affect system behavior and trigger recurring outbound messages. The documentation does not include an explicit caution that this is unattended scheduled execution and will continue until removed.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 查看当前 cron 配置
crontab -l

# 如需手动添加：
echo "0 9 * * 1-5 /home/admin/.openclaw/workspace/skills/arxiv-daily-skill/cron_run.sh" | crontab -

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares capabilities that imply file reads/writes, shell execution, and network access, but it does not explicitly scope or constrain those powers with a permissions or allowed-tools section. For a scheduled skill that can write local files and send outbound webhook requests, this lack of least-privilege declaration increases the chance of unsafe execution, overbroad access, or later abuse if companion scripts behave unexpectedly.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Broad, conversational trigger phrases like '看看今天的论文' can cause unintended activation, especially in chat environments where ordinary language overlaps with control intents. In a skill that performs network access, local writes, and external webhook posting, accidental invocation can lead to unnecessary outbound traffic and unintentional data handling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that it will push content to a Feishu webhook and save reports locally, but it does not clearly disclose write destinations, retention, or what data may be transmitted externally. Missing transparency around outbound transmission and filesystem writes can cause unintentional data exposure, especially if reports include user prompts, internal notes, or enriched metadata.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: L087 明确要求“分析使用中文”，这构成了固定语言输出约束，但文档中没有说明这是用户可选项，也没有给出必须限定中文的合规或地区场景理由。按规则，这属于自然语言层面的语言/locale 政策问题。

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script posts generated report content to a Feishu webhook using curl, which transmits locally generated data off the system. Although the step is logged, there is no explicit disclosure that report content will be sent to an external service or what data is included, and that behavior is not inherently obvious from the shell code alone.

External Transmission

Medium

• Category: Data Exfiltration

Content

)
    
    # 发送飞书消息
    RESPONSE=$(curl -s -X POST "$FEISHU_WEBHOOK" \
        -H "Content-Type: application/json" \
        -d "$MESSAGE")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a skill that automatically collects daily arXiv papers in specific topics, includes institution information, and pushes results to Feishu. In contrast, this file is a command-line tool for fetching one arXiv paper by ID and generating a local markdown-style report, with no daily scheduling or Feishu delivery behavior.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring says the tool supports detailed interpretation by invoking ljg-paper skill logic. However, the implementation never invokes another skill or analysis engine; it only fetches arXiv metadata and emits stub sections with text such as '需要调用 ljg-paper skill 进行深度解读...' and '（待分析）'.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description and all user-facing strings indicate the skill is designed to produce Chinese analysis only, including prompting users to request a Chinese interpretation. This is a natural-language locale policy issue because the skill imposes a specific language without documenting user choice or opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file description and subsequent user-facing strings indicate the skill is designed to present summaries and status messages in Chinese, but there is no option for the user to select language or opt in to this locale. This is a natural-language policy concern because the skill imposes a specific language across its interface and output.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The generated report includes a hard-coded "中文摘要" section, which directs the skill to present content in Chinese regardless of user preference. Because no alternative language path or opt-in is provided, this constitutes a language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Comments and console output are written in Chinese, including the primary user-facing status messages. This can violate the language/locale policy when a specific language is forced without user opt-in or clear documentation that the skill is intended only for that locale.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says the skill will collect arXiv papers, include institution information, and push results to Feishu. This script only defines arXiv search queries, fetches raw API responses, and prints them to stdout; there is no logic to extract author affiliations/institutions and no outbound call or webhook integration for Feishu delivery.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python file contains natural-language descriptions and console messages in Chinese, which effectively forces a specific language for users running or maintaining the skill. The policy for this audit flags language/locale constraints unless the skill offers user opt-in or clearly documents a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The script prints status, failure, and output-label messages in Chinese during execution. Because no language selection or opt-in is provided, this is a natural-language locale policy issue under the audit criteria.

Static analysis

No suspicious patterns detected.