ClawHub
Back to skill

Security audit

PaperPod

Security checks for vulnerabilities and agentic risk

Overview

PaperPod is a coherent remote sandbox/runtime skill, but it asks users to install a mutable global CLI and use broad code execution, persistent memory, background processes, and public port exposure with limited safety guidance.

Install only if you trust PaperPod and are comfortable sending work to its hosted service. Treat PaperPod tokens as secrets, avoid storing credentials or private data in persistent memory, expose only non-sensitive services, clean up background processes and memory when done, and prefer a pinned CLI version or reviewed installation path rather than unrestricted global npm install/update.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
npm install -g @paperpod/cli

A related unsafe update instruction appears at SKILL.md, line 83:

bash
npm update -g @paperpod/cli

Technical Analysis

The installation command does not pin @paperpod/cli to a reviewed version or verify its integrity. It therefore installs whichever package version the npm registry resolves at execution time. The update instruction similarly permits future, unaudited package content to replace the installed CLI.

npm packages can define lifecycle scripts that execute during installation with the permissions of the invoking user. Consequently, compromise of the package, its publisher account, or its distribution channel could convert this documented installation step into arbitrary local code execution. Global installation increases exposure because it modifies the user's shared npm environment and makes the CLI available system-wide within that user's installation scope.

The audited project does not itself contain a malicious payload, and no compromise of the named package was established. The issue is the mutable and unverified dependency acquisition process.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or another relevant supply-chain component.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented npm install -g @paperpod/cli or npm update -g @paperpod/cli instruction.
  4. npm resolves and downloads the attacker-controlled release because no reviewed version or integrity value is specified.
  5. Malicious package code or lifecycle scripts execute locally with the invoking user's permissions.
  6. The attacker can access or modify resources available to that user and can alter the globally installed CLI.

Impact Assessment

Successful exploi ...[truncated 482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specific, reviewed version, for example:
    bash
    npm install -g @paperpod/cli@2.0.3
  2. Verify the selected release and document its expected registry source and integrity digest.
  3. Avoid instructing users to run an unrestricted npm update -g; instead, specify an explicitly reviewed target version.
  4. Prefer a project-local dependency with a committed lockfile over a global installation where operationally feasible.
  5. Publish and verify signed release artifacts or package provenance.
  6. Review required npm lifecycle scripts and use --ignore-scripts when installation scripts are unnecessary.
  7. Document a controlled upgrade process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (25)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The Python example uses subprocess.run with shell=True, which is dangerous because any future interpolation of user-controlled input into that command string can lead to shell injection. In a skill explicitly designed for code execution and shell tooling, this pattern is more hazardous because users are likely to copy it into real workflows involving variable input.

Content

Scanner excerpt · references/shell-tools.md (reported line 40)May include surrounding context.

python
import subprocess
result = subprocess.run("git --version", shell=True, capture_output=True, text=True)
print(result.stdout)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Quick Start

bash
curl -X POST https://paperpod.dev/login -d '{"email":"you@email.com"}'  # Verify and get token
npm install -g @paperpod/cli
ppod login <token> && ppod help

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation instructs users to place bearer tokens in environment variables and HTTP headers but does not emphasize that these tokens are credentials that must be protected from logs, shell history, screenshots, and process inspection. In practice, agents and users often echo commands or persist environment state, which increases the chance of credential leakage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
| | `ppod write <path> [file]` | Write file (stdin if no file) |
| | `ppod read <path>` | Read file |
| | `ppod ls <path>` | List directory |
| **Processes** | `ppod start <cmd>` | Start background process |
| | `ppod ps` | List processes |
| | `ppod kill <id>` | Stop process |
| **Ports** | `ppod expose <port>` | Get public URL (-q for URL only) |

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
| | `ppod write <path> [file]` | Write file (stdin if no file) |
| | `ppod read <path>` | Read file |
| | `ppod ls <path>` | List directory |
| **Processes** | `ppod start <cmd>` | Start background process |
| | `ppod ps` | List processes |
| | `ppod kill <id>` | Stop process |
| **Ports** | `ppod expose <port>` | Get public URL (-q for URL only) |

Session Persistence

Medium
Category
Rogue Agent
Confidence
55% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
| | `ppod ai:models` | List available AI models |
| **Code** | `ppod interpret <code>` | Rich output (charts) |
| **Memory** | `ppod mem:write <path>` | Persist data |
| | `ppod mem:read <path>` | Read persisted data |
| | `ppod mem:ls` | List memory files |
| | `ppod mem:rm <path>` | Delete from memory |
| | `ppod mem:usage` | Check quota |

Session Persistence

Medium
Category
Rogue Agent
Confidence
55% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
| | `ppod ai:models` | List available AI models |
| **Code** | `ppod interpret <code>` | Rich output (charts) |
| **Memory** | `ppod mem:write <path>` | Persist data |
| | `ppod mem:read <path>` | Read persisted data |
| | `ppod mem:ls` | List memory files |
| | `ppod mem:rm <path>` | Delete from memory |
| | `ppod mem:usage` | Check quota |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly advertises persistent memory and public port exposure but does not clearly warn that stored data may outlive a sandbox session or that exposed services become reachable from the public internet. In an agent context, this can lead to accidental publication of sensitive files, debug endpoints, or stateful secrets when users assume the environment is temporary and private.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 15)May include surrounding context.

bash
# 1. Request magic link
curl -X POST https://paperpod.dev/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@email.com"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The refresh example places a live-style session token directly in the request body, which encourages patterns that can leak tokens through shell history, logs, clipboard reuse, or copied examples. Because the token is long-lived and grants authenticated access, poor handling can lead to account compromise if reused carelessly.

Content

Scanner excerpt · references/api-reference.md (reported line 33)May include surrounding context.

Tokens expire in 15 days. Refresh before expiry:

bash
curl -X POST https://paperpod.dev/auth/refresh \
  -d '{"token":"pp_sess_..."}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file describes endpoints that execute Python/JavaScript/shell code and start background processes, but it does not include any user warning about the risks of running arbitrary code or commands. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file documents /files/write, /memory/write, and /memory/delete operations, but it does not warn users that these actions can overwrite or remove stored data. In markdown documentation, omission of warnings for behaviors affecting user data matches the missing-user-warnings rule.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 76)May include surrounding context.

POST /files/write

bash
curl -X POST https://paperpod.dev/files/write \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"path": "/workspace/app.py", "content": "print(\"hello\")"}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

Background process support creates persistence within the runtime and can be combined with port exposure, file writes, and code execution to maintain long-running services or unwanted tasks beyond a single request. In this skill context, that expands the window for abuse, covert activity, and unintended resource consumption if users are not clearly warned or constrained.

Content

Scanner excerpt · references/api-reference.md (reported line 103)May include surrounding context.

POST /process/start

Start a background process.

bash
curl -X POST https://paperpod.dev/process/start \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The /expose endpoint makes a local service publicly reachable and the documentation provides usage guidance without any security warning about unauthenticated access, accidental data exposure, or internet-facing attack surface. In a tool that also supports process start and file operations, exposing arbitrary ports can easily publish admin panels, dev servers, or sensitive application state.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Calling /expose sends a request that results in a publicly reachable URL, effectively transmitting local service availability and potentially whatever data that service exposes to the internet. In the context of a runtime that can start arbitrary processes, this materially increases risk of unintended public data disclosure or remote interaction with development services.

Content

Scanner excerpt · references/api-reference.md (reported line 138)May include surrounding context.

Expose a port and get a public URL.

bash
curl -X POST https://paperpod.dev/expose \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"port": 8080}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 204)May include surrounding context.

POST /browser/screenshot

bash
curl -X POST https://paperpod.dev/browser/screenshot \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"url": "https://example.com"}' \
  --output screenshot.png

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 220)May include surrounding context.

POST /browser/pdf

bash
curl -X POST https://paperpod.dev/browser/pdf \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"url": "https://example.com", "format": "A4"}' \
  --output page.pdf

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 241)May include surrounding context.

Scrape elements by CSS selector.

bash
curl -X POST https://paperpod.dev/browser/scrape \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"url": "https://example.com", "selector": "h1, h2, p"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 299)May include surrounding context.

Generate text embeddings.

bash
curl -X POST https://paperpod.dev/ai/embed \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"text": "Hello world"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 327)May include surrounding context.

Transcribe audio to text.

bash
curl -X POST https://paperpod.dev/ai/transcribe \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"audio": "<base64-encoded-audio>"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents commands that execute shell operations, make HTTP requests, clone repositories, and create or modify local files and databases. Under the markdown-file criteria, the description should warn users that these examples may change files, access networks, or interact with system state, but no such warning is present.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Use language: "shell" with /execute:

bash
curl -X POST https://paperpod.dev/execute \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"code": "git clone https://github.com/user/repo", "language": "shell"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/shell-tools.md (reported line 31)May include surrounding context.

Use language: "shell" with /execute:

bash
curl -X POST https://paperpod.dev/execute \
  -H "Authorization: Bearer $PAPERPOD_TOKEN" \
  -d '{"code": "git clone https://github.com/user/repo", "language": "shell"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/shell-tools.md (reported line 66)May include surrounding context.

ppod exec "cat data.json | jq '.users[].name'"

API response processing

ppod exec "curl -s https://api.example.com/data | jq '.results | length'"

text

### ffmpeg

Static analysis

No suspicious patterns detected.