Security audit

Paper Style Review

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its paper-review purpose, but it needs review because it can send manuscript text to LLM services chosen from ambient/global settings and can automatically delete prior generated outputs.

Install only if you are comfortable sending the target paper and reference-paper excerpts to the configured LLM provider. Use an isolated output directory, explicit skill-specific LLM settings, and a limited API key; avoid relying on generic OPENAI_* or global OpenClaw provider defaults. Keep originals outside the output directory and review generated annotated documents before sharing them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and orchestrates operations that imply reading input documents, writing outputs, modifying Word files, and potentially using external services for fused LLM review, yet it declares no permissions. This mismatch is dangerous because users and policy engines cannot accurately understand or constrain what the skill will access, increasing the risk of overbroad file or network access when handling sensitive papers.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: 参考文献检查中出现与格式校验无关的特判条件 `and "Insecure" not in text`，这会让包含该关键词的专著条目绕过出版地/出版社完整性检查。虽然不是传统 RCE 类漏洞，但它在安全分析和质量审校场景里构成可被利用的规则绕过，攻击者或规避者可通过插入该词逃避检测。

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This code loads provider definitions and API credentials from a global ~/.openclaw/openclaw.json state, not just from task-scoped inputs. In a document-review skill, that expands trust boundaries and can silently route user document content to any globally configured provider, which creates unintended credential use and data exfiltration risk.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The resolver inspects generic OPENAI_* and custom PAPER_STYLE_REVIEW_LLM_* environment variables to obtain API base URLs, keys, model refs, and routing. That allows the skill to inherit ambient secrets and network destinations from the host environment, so sensitive thesis text may be transmitted through unintended accounts or third-party endpoints without clear isolation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description and usage guidance do not clearly warn that it writes review artifacts and produces a modified .docx by injecting comments. That omission can lead users to run it on important documents without realizing it will create or alter files, causing unintended modification of originals, data leakage into outputs, or workflow integrity issues in document-review environments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This module sends full paragraph text to an external LLM via `call_llm_json`, and the prompt construction includes raw thesis content for every paragraph in a package. In a paper-review skill, those paragraphs may contain unpublished research, personal data, proprietary content, or sensitive academic material; without explicit consent controls, minimization, or disclosure in this component, this creates a real confidentiality and data-governance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: call_llm sends prompt content, including thesis paragraphs, reference papers, and review context, directly to external OpenAI-compatible APIs. In this skill, the reviewed material can contain unpublished research or sensitive academic content, so silent external transmission is a meaningful privacy and confidentiality risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The orchestrator unconditionally deletes prior generated outputs in the configured output directory before each run, including any matching '*-annotated.docx' files. This is dangerous because a misconfigured or reused output directory can cause unintended data loss or destruction of artifacts the user expected to keep, especially when the deletion happens automatically and recursively across known filenames.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code sends target and reference document text, chapter content, and style material into an LLM review pipeline without any visible consent gate, redaction step, or locality enforcement. If the configured LLM uses a remote service, sensitive paper contents, unpublished research, or personal data may be exfiltrated to third parties, creating confidentiality and compliance risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code passes full paragraph text from the target document into `classify_section_packages(paragraphs, llm_config=llm_config)`, and each paragraph object includes raw `text` plus structural metadata. For a thesis-review skill, documents commonly contain unpublished research, personal information, or confidential material, so sending that content to an LLM without explicit disclosure, consent, minimization, or provider controls creates a real data-exposure risk rather than a mere quality issue.

Static analysis

No suspicious patterns detected.