ClawHub
Back to skill

Security audit

๐Ÿ“š ๆ™บ่ƒฝๆ–‡็Œฎ็ปผ่ฟฐ็”Ÿๆˆๅ™จ

Security checks for vulnerabilities and agentic risk

Overview

This literature-review helper is purpose-aligned and transparent overall, though it overstates some features and sends research queries to external academic APIs.

Install only if you are comfortable sending search terms to external scholarly APIs. Avoid using sensitive unpublished research queries over the arXiv source until its endpoint is changed to HTTPS, and treat the advertised advanced review features as incomplete.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 ยท Insecure Skill Coding Practices

Warning
Location
scripts/lit_search.py:27
Finding

Unencrypted arXiv API Traffic Permits Query Disclosure and Metadata Tampering

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code substantially matches several declared functions: multi-source literature search across the named sources, DOI/arXiv validation, conflict detection, citation formatting in the listed formats, and generation of a simple review summary with timeline/statistics. However, important parts of the declared description are not implemented. There is no logic for PICO, Boolean, or MeSH-guided systematic searching; no keyword extraction; and no source-quality tagging. The review generation is limited to a markdown summary with statistics, timeline, and paper entries, rather than a fuller writing assistant for the 'full lifecycle' of review drafting. This makes the description materially overstated relative to the actual code, though there are no obvious undeclared harmful capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises and instructs use of capabilities that imply network access and local file interaction, but it declares no explicit tool scope or permissions. In an agent environment, this creates an authorization gap where reviewers and runtime policy may not clearly constrain what the skill is allowed to access, increasing the risk of unintended network requests or file reads/writes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท references/api_reference.md (reported line 141)May include surrounding context.

Endpoint

text
GET https://api.datacite.org/dois

Parameters

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L205 suggests adding a mandatory filter of "English" when narrowing results. This imposes a language constraint in the skill content without offering a user choice or documenting a justified region-specific need, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module usage docs show python3 lit_search.py file://papers.txt -f bibtex, implying file-driven processing of paper IDs, which fits the manifest's validation/formatting workflow. However, main() exits early in file mode with a TODO and never resolves IDs to papers, validates them, or formats them, so the advertised workflow is not actually supported.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level docstring presents file-based invocation as supported behavior. In contrast, the code path for file:// input merely loads IDs, prints a count, and returns immediately with a TODO: ้€š่ฟ‡ ID ่Žทๅ–่ฎบๆ–‡่ฏฆๆƒ…, directly contradicting the documentation's implication that formatting/output will occur.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท references/api_reference.md (reported line 7)May include surrounding context.

md
"timeout": 30,
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "timeout": 30,
        "requires_key": False,
    },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท scripts/lit_search.py (reported line 31)May include surrounding context.

python
"timeout": 30,
    },
    "semantic_scholar": {
        "base_url": "https://api.semanticscholar.org/graph/v1/paper/search",
        "timeout": 30,
        "requires_key": False,
    },

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท references/api_reference.md (reported line 42)May include surrounding context.

md
"requires_key": False,
    },
    "openalex": {
        "base_url": "https://api.openalex.org/works",
        "timeout": 30,
    },
    "crossref": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท scripts/lit_search.py (reported line 36)May include surrounding context.

python
"requires_key": False,
    },
    "openalex": {
        "base_url": "https://api.openalex.org/works",
        "timeout": 30,
    },
    "crossref": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท references/api_reference.md (reported line 77)May include surrounding context.

md
"timeout": 30,
    },
    "crossref": {
        "base_url": "https://api.crossref.org/works",
        "timeout": 30,
    },
    "pubmed": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท references/api_reference.md (reported line 201)May include surrounding context.

md
"timeout": 30,
    },
    "crossref": {
        "base_url": "https://api.crossref.org/works",
        "timeout": 30,
    },
    "pubmed": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt ยท scripts/lit_search.py (reported line 40)May include surrounding context.

python
"timeout": 30,
    },
    "crossref": {
        "base_url": "https://api.crossref.org/works",
        "timeout": 30,
    },
    "pubmed": {

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The stated capability includes systematic search using PICO, Boolean, and MeSH frameworks across sources. The actual search code passes the user-supplied query directly into each API request and contains no parsing, expansion, ontology handling, or query-construction logic for PICO/Boolean/MeSH-based search strategies.

Content

No source excerpt is available for this finding.

Tainted flow: 'summary_params' from requests.get (line 462, network input) โ†’ requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt ยท scripts/lit_search.py (reported line 468)May include surrounding context.

python
"retmode": "json",
            }
            
            resp = requests.get(summary_url, params=summary_params, timeout=30)
            resp.raise_for_status()
            summary_data = resp.json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest advertises an auto-generated structured literature review including timeline, keyword extraction, and source-quality tagging. In code, ReviewGenerator.generate only aggregates source/year counts and emits a simple markdown list of papers and abstracts; there is no keyword extraction logic or any source-quality assessment/tagging implemented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing documentation where parameter tables and many section labels are written in Chinese, but there is no indication that the skill is intentionally region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest scopes the skill to searches across arXiv, Semantic Scholar, OpenAlex, CrossRef, and PubMed, plus citation output in APA 7th, MLA 9th, IEEE, BibTeX, RIS, and Markdown. This reference adds DataCite as an API source and lists Chicago formatting, expanding documented behavior beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains mixed-language natural-language instructions, including Chinese-only usage examples and descriptions, but does not indicate that the language is optional or configurable. That can violate a language/locale policy where tools should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The tool accepts a user-controlled local file path via file:// and also writes results to an arbitrary output path without restriction or safety prompts. In an agent setting, this can be abused to read unexpected local files or overwrite files the agent has access to, especially if untrusted prompts can influence CLI arguments.

Content

No source excerpt is available for this finding.