Arxiv Daily Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but its setup and helper scripts can make persistent system changes and handle network data in unsafe ways that users should review before installing.

Review and fix the cron setup before installing: preserve existing crontab entries, run under an unprivileged account, and add an uninstall command. Use HTTPS for arXiv, remove `xmllint --noent` or the alternate shell fetcher, and store reports in a private directory rather than predictable `/tmp` paths. Only configure the Feishu webhook for a destination where sending paper-report previews is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:49

Finding

Destructive replacement of the user's existing crontab

Content

View full analysis

Remediation

View remediation

/dev/null || true printf '%s\n' "$CRON_ENTRY" ) | awk '!seen[$0]++' | crontab - ``` Additional hardening measures: 1. Replace the hardcoded account path with an installer-resolved absolute path. 2. Clearly state that the job should be installed under an unprivileged user. 3. Display the proposed cron entry and obtain explicit approval before installation. 4. Provide an uninstall command that removes only the Skill's entry. 5. Consider using a uniquely marked managed block so updates do not affect unrelated jobs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.sh:20

Finding

MITM-assisted XML external entity expansion in the alternate shell fetcher

Content

View full analysis

/dev/null \ || curl -s "http://export.arxiv.org/api/query?search_query=${query}&sortBy=submittedDate&sortOrder=descending&max_results=${max_results}" ``` ### Technical Analysis The script downloads XML over plaintext HTTP and passes it to `xmllint --noent`. The `--noent` option substitutes entity references and is unsafe for untrusted XML because a document can define external entities that reference local files or other resources. Because HTTP does not authenticate the server response, an attacker capable of intercepting or modifying network traffic can replace the arXiv response with malicious XML. A representative payload is: ```xml ]> &disclosure; ``` If the installed libxml configuration permits the relevant external resource resolution, `xmllint --noent` expands the entity and emits the referenced content. Entity expansion can also consume excessive resources, and some configurations may permit requests to internal network services. ### Attack Path 1. The user executes `index.sh`. 2. The script requests the arXiv API through plaintext HTTP. 3. An attacker on the network path intercepts or alters the response. 4. The attacker supplies XML containing a `DOCTYPE` and an external entity. 5. `xmllint --noent` parses and expands the attacker-defined entity. 6. Readable local file content may be included in standard output, terminal capture, automation logs, or downstream processing. The attacker must be able to modify the network response, such as through a hostile acce ...[truncated 812 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: fetch_arxiv.py:13

Finding

Paper-feed integrity can be compromised through plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: cron_run.sh:8

Finding

Predictable files in a shared temporary directory permit symlink-based overwrite

Content

View full analysis

"$OUTPUT_FILE" 2>&1 ``` ```bash PREVIEW_FILE="/tmp/arxiv_preview_$(date +%Y%m%d).txt" head -30 "$OUTPUT_FILE" > "$PREVIEW_FILE" ``` The manual launcher contains the same output pattern at `run.sh:10-17`: ```bash OUTPUT_FILE="/tmp/arxiv_daily_$(date +%Y%m%d).md" python3 "$SCRIPT_DIR/fetch_arxiv.py" > "$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis The scripts create report files directly under the shared `/tmp` directory using names that can be predicted from the current date. Shell output redirection opens the target path and generally follows symbolic links. A local attacker may pre-create the expected path as a symbolic link to another file. When the scheduled task runs, redirection can truncate and overwrite that target with report data, provided the executing account has permission to write the target and operating-system symlink protections do not block the operation. Even when symlink protections prevent exploitation, pre-created files can cause ownership conflicts or denial of service. ### Attack Path 1. A local attacker determines the date of the next scheduled execution. 2. The attacker predicts paths such as `/tmp/arxiv_daily_20260916.md`. 3. The attacker creates a symbolic link at the predicted path pointing to a file writable by the cron account. 4. The scheduled process opens the predictable pathname through shell redirection. 5. If platform protections permit the operation, the linked target is truncated and replaced with generated report output. 6. The same technique can target the predictable preview file. Exploitation requires local filesyst ...[truncated 691 chars]

Remediation

View remediation

"$OUTPUT_FILE" 2>&1 head -30 "$OUTPUT_FILE" > "$PREVIEW_FILE" ``` If reports must persist after execution: 1. Store them in a dedicated directory owned by the Skill's unprivileged user. 2. Set the directory mode to `0700` or another appropriately restrictive mode. 3. Create final files atomically and refuse to overwrite symbolic links. 4. Use a random temporary filename and then move the completed report to its destination. 5. Avoid running the cron task as root or another privileged service account. 6. Apply the same correction to both `cron_run.sh` and `run.sh`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述了一个每日收集 arXiv 特定方向论文并附带机构信息、再进行飞书推送的技能。实际提供的代码片段主要负责调度与推送：执行另一个脚本 fetch_arxiv.py、处理输出文件、并通过 curl 向飞书 webhook 发消息。由于声明中的权限为空，但代码实际存在明确的网络发送行为和配置读取行为，属于未声明能力。另一个重要点是，这个代码片段自身并不能证明其确实完成了“LLM/RAG/Agent 方向筛选”和“机构信息补充”，这些核心功能都在外部脚本中，当前片段只能确认推送包装逻辑。因此描述与所给代码行为并不完全一致，存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个自动化论文监控/推送技能：定期收集特定方向 arXiv 论文、补充机构信息并发送到飞书。实际代码仅对用户提供的单篇 arXiv 论文 ID 执行页面抓取，解析基础元数据，并拼装一个待补全的“深度分析”报告模板后打印输出。它没有体现自动化收集、主题范围过滤、批量处理、定时任务、消息推送或飞书集成。虽然两者都与 arXiv 论文和机构信息有关，但核心功能和运行方式明显不同，因此属于实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

描述与代码部分一致：代码确实会搜集 arXiv 论文并补充机构信息。但存在几个实质性偏差。首先，声明中的“飞书推送”在代码中没有实现；输出仅为控制台打印的 Markdown 文本，没有任何飞书 API、Webhook 或消息发送逻辑。其次，论文抓取范围不止 LLM/RAG/Agent，还包含 Transformer、Harness、Reasoning，超出了声明的主题范围。再次，代码除了调用 arXiv API 外，还会访问 arXiv 论文 HTML 页面以推断机构，并把结果写入本地 affiliations_db.json 持久化保存，这属于描述中未体现的额外行为。综合看，整体目的接近，但描述未准确覆盖关键行为且包含未实现能力，因此应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

代码的核心行为与“搜集 arXiv 论文”部分基本一致：它确实向 arXiv API 发起与 LLM/RAG/Agent 等相关的查询并获取结果。但描述中的几个关键能力在代码中没有体现：1）没有解析作者机构信息；2）没有任何飞书 webhook 或消息发送逻辑；3）Triggers 为空，代码本身也没有定时调度机制，因此“每日自动”未被实现；4）parse_entry 函数甚至未被使用，整体只是打印抓取到的 XML/响应内容，而非完整的精选整理与推送。因此描述对功能有明显夸大，属于不准确表述。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明的核心能力包括：按日自动搜集特定方向 arXiv 论文、附带机构信息、并通过飞书推送。实际代码片段只展示了一个本地执行入口：调用 fetch_arxiv.py 生成报告文件并在命令行预览前 20 行。片段中没有任何飞书 API、Webhook、消息发送逻辑；也没有可见的机构信息处理逻辑；触发器为空且脚本本身未体现“每日自动”调度。虽然抓取 arXiv 论文这一部分与声明部分一致，但声明中的关键交付方式（飞书推送）和内容增强（机构信息）在该代码片段中都未得到体现，因此描述与行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述的是一个完整自动化流程：定期从 arXiv 搜集特定方向论文、附带机构信息、并发送到飞书。实际代码仅实现其中一个子功能——对指定 arXiv ID 的页面进行机构信息提取，并在本地打印测试结果。它没有展示定时触发、论文抓取/筛选、消息推送等核心能力。虽然“带机构信息”这一点与代码部分一致，但整体主用途与声明相比明显不完整，且更像开发/测试辅助脚本，因此属于描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · cron_run.sh (reported line 86)May include surrounding context.

sh

)
    
    # 发送飞书消息
    RESPONSE=$(curl -s -X POST "$FEISHU_WEBHOOK" \
        -H "Content-Type: application/json" \
        -d "$MESSAGE")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file states that the skill collects papers, structures a report, and pushes it via Feishu, which is a network action transmitting generated content to an external service. It also later describes saving full reports to local files, but the README does not clearly warn users about these privacy/system-impacting behaviors up front.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README instructs users to install a cron job that executes the skill every weekday, which can affect system behavior and trigger recurring outbound messages. The documentation does not include an explicit caution that this is unattended scheduled execution and will continue until removed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

bash

# 查看当前 cron 配置
crontab -l

# 如需手动添加：
echo "0 9 * * 1-5 /home/admin/.openclaw/workspace/skills/arxiv-daily-skill/cron_run.sh" | crontab -

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares capabilities that imply file reads/writes, shell execution, and network access, but it does not explicitly scope or constrain those powers with a permissions or allowed-tools section. For a scheduled skill that can write local files and send outbound webhook requests, this lack of least-privilege declaration increases the chance of unsafe execution, overbroad access, or later abuse if companion scripts behave unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad, conversational trigger phrases like '看看今天的论文' can cause unintended activation, especially in chat environments where ordinary language overlaps with control intents. In a skill that performs network access, local writes, and external webhook posting, accidental invocation can lead to unnecessary outbound traffic and unintentional data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states that it will push content to a Feishu webhook and save reports locally, but it does not clearly disclose write destinations, retention, or what data may be transmitted externally. Missing transparency around outbound transmission and filesystem writes can cause unintentional data exposure, especially if reports include user prompts, internal notes, or enriched metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L087 明确要求“分析使用中文”，这构成了固定语言输出约束，但文档中没有说明这是用户可选项，也没有给出必须限定中文的合规或地区场景理由。按规则，这属于自然语言层面的语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script posts generated report content to a Feishu webhook using curl, which transmits locally generated data off the system. Although the step is logged, there is no explicit disclosure that report content will be sent to an external service or what data is included, and that behavior is not inherently obvious from the shell code alone.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · cron_run.sh (reported line 86)May include surrounding context.

sh

)
    
    # 发送飞书消息
    RESPONSE=$(curl -s -X POST "$FEISHU_WEBHOOK" \
        -H "Content-Type: application/json" \
        -d "$MESSAGE")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that automatically collects daily arXiv papers in specific topics, includes institution information, and pushes results to Feishu. In contrast, this file is a command-line tool for fetching one arXiv paper by ID and generating a local markdown-style report, with no daily scheduling or Feishu delivery behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring says the tool supports detailed interpretation by invoking ljg-paper skill logic. However, the implementation never invokes another skill or analysis engine; it only fetches arXiv metadata and emits stub sections with text such as '需要调用 ljg-paper skill 进行深度解读...' and '（待分析）'.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and all user-facing strings indicate the skill is designed to produce Chinese analysis only, including prompting users to request a Chinese interpretation. This is a natural-language locale policy issue because the skill imposes a specific language without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file description and subsequent user-facing strings indicate the skill is designed to present summaries and status messages in Chinese, but there is no option for the user to select language or opt in to this locale. This is a natural-language policy concern because the skill imposes a specific language across its interface and output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated report includes a hard-coded "中文摘要" section, which directs the skill to present content in Chinese regardless of user preference. Because no alternative language path or opt-in is provided, this constitutes a language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Comments and console output are written in Chinese, including the primary user-facing status messages. This can violate the language/locale policy when a specific language is forced without user opt-in or clear documentation that the skill is intended only for that locale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill will collect arXiv papers, include institution information, and push results to Feishu. This script only defines arXiv search queries, fetches raw API responses, and prints them to stdout; there is no logic to extract author affiliations/institutions and no outbound call or webhook integration for Feishu delivery.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains natural-language descriptions and console messages in Chinese, which effectively forces a specific language for users running or maintaining the skill. The policy for this audit flags language/locale constraints unless the skill offers user opt-in or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script prints status, failure, and output-label messages in Chinese during execution. Because no language selection or opt-in is provided, this is a natural-language locale policy issue under the audit criteria.

Content

No source excerpt is available for this finding.