ClawHub
Back to skill

Security audit

Research Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent research automation workflow, but it can automatically write research notes and send research digests through Feishu without clear user opt-in or scoping controls.

Review this skill before installing if your research topics, paper choices, or Obsidian vault links are private. It should be configured to ask before writing notes or sending Feishu messages, and recurring cron use should be limited to topics and destinations you explicitly approve.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation text is broad enough to trigger on many ordinary research-related requests, which can cause the skill to run automatically in situations where the user only wanted advice or a lightweight response. Because the skill performs searches, summarization, note creation, file maintenance, and external reporting, overbroad invocation increases the risk of unintended actions and data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs creation and maintenance of Obsidian notes and a workspace tracking file without clearly warning the user that local files will be modified. In an agent setting, silent persistence can overwrite, clutter, or expose sensitive research organization data, especially under automatic or recurring execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises a workflow centered on arXiv search, summarization, and Obsidian note-taking, but additionally instructs sending a digest via Feishu. This hidden external communication expands the data-flow surface and can disclose research activity or derived notes to a third-party channel without clear upfront notice or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends research digests via Feishu without warning that research topics, paper selections, and note links may be transmitted outside the local environment. External messaging introduces confidentiality and privacy risk, particularly for unpublished interests, internal research directions, or links into a private knowledge base.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.