Security audit

arxiv-weekly-report

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed arXiv reporting helper, but its PDF extraction utility can fetch arbitrary URLs and write/cache files more broadly than the arXiv-only purpose requires.

Review this skill before installing if your agent has access to internal networks or sensitive files. Prefer using arXiv IDs or arXiv-generated PDF links only, avoid passing arbitrary --pdf-url values, and run PDF extraction in a constrained workspace. Expect persistent report/cache files under the skill directory and consider pinning pypdf before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_arxiv_pdf_text.py:158
Finding: Unrestricted PDF URL Retrieval and User-Controlled Output Directories
Content: View full analysis
None: req = urllib.request.Request( url, headers={ "User-Agent": "OpenClaw-arxiv-weekly-report/0.1 (Python urllib)" }, ) with urllib.request.urlopen(req, timeout=timeout) as resp, open(output_path, "wb") as f: f.write(resp.read()) ``` ```python ensure_dir(args.pdf_dir) if arxiv_id: base_name = arxiv_id else: base_name = f"arxiv_pdf_{hashed_name(pdf_url)}" pdf_path = os.path.join(args.pdf_dir, f"{safe_filename(base_name)}.pdf") try: if not os.path.exists(pdf_path) or os.path.getsize(pdf_path) == 0: download_file(pdf_url, pdf_path, timeout=args.timeout) ``` ### Technical Analysis When a value supplied through `--pdf-url` does not match the expected arXiv PDF path, `resolve_source()` preserves the URL unchanged. The resulting value is passed directly to `urllib.request.urlopen()`. There is no validation of: - The URL scheme or destination hostname. - The resolved destination address. - Redirect destinations. - Private, loopback, link-local, or cloud metadata addresses. - The r ...[truncated 2584 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:138
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to produce innovation summaries and a finished weekly report, but the implementation reportedly only returns intermediate JSON and lacks the promised summarization/report generation. While not a direct exploit primitive, this mismatch is a security-relevant integrity issue because users may trust outputs or workflow side effects that are not actually performed, leading to unsafe assumptions and broken auditability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to produce innovation summaries and a finished weekly report, but the implementation reportedly only returns intermediate JSON and lacks the promised summarization/report generation. While not a direct exploit primitive, this mismatch is a security-relevant integrity issue because users may trust outputs or workflow side effects that are not actually performed, leading to unsafe assumptions and broken auditability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to use network access and write files to disk, but it declares no tool scope or permission boundary. This creates an authorization gap where a caller may not realize the skill can reach external services and persist data locally, increasing the risk of unintended data exposure or misuse of agent capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mandates creating a directory and writing Markdown reports to disk without prior user warning or explicit consent. Unannounced filesystem writes can leak query contents, research interests, or derived text into persistent storage, and may overwrite or accumulate files in a sensitive environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file sets a default language policy of Chinese output, and earlier sections also frame the report as a structured Chinese weekly report unless the user explicitly requests English. This forces a specific language by default rather than offering a neutral choice or obtaining user opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains user-facing natural-language content entirely in Chinese in the module docstring, CLI help text, and error messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script accepts a raw --pdf-url and, when the URL does not parse as an arXiv PDF, still uses the supplied URL directly for download. That expands behavior from 'fetch arXiv papers' into a generic remote fetch primitive, which can be abused for out-of-scope network access, SSRF-like requests to internal endpoints, or retrieval of attacker-controlled PDFs that may trigger parser bugs or resource exhaustion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code path exposes a general-purpose remote PDF downloader unrelated to the narrowly described skill purpose of generating weekly arXiv reports. In agent environments, unnecessary network-fetch capability increases attack surface because untrusted inputs can steer the tool to external resources, enabling data exfiltration paths, SSRF-style access, or parsing of malicious files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language documentation and CLI help text entirely in Chinese, including the module docstring and argument descriptions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.