ClawHub
Back to skill

Security audit

paper-writer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed academic paper-writing workflow with local validation scripts and citation-checking safeguards, with no evidence of hidden access, persistence, or exfiltration.

Install only if you want an agent to help draft new academic papers and run local compliance checks. Do not treat the citation ledger as proof by itself; cited sources still need real lookup and academic use must follow your school, publisher, or workplace rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The docstring repeatedly states that the script never asserts real-world citation existence, but the PASS message says all citations are 'RESOLVED (looked up, real, matching)' and may state they 'resolve.' Because the script only checks ledger completeness and marker consistency, a forged or careless ledger can cause false assurance that sources are real, enabling fabricated citations or unsupported claims to be shipped as verified in an academic-writing skill where trust in references is central.

Vague Triggers

Medium
Confidence
72% confidence
Finding
Broad triggers can cause the skill to activate on general writing requests where users did not intend a full paper-generation workflow. In this context, unintended invocation is more concerning because the skill is designed to produce complete academic papers, which can facilitate academic misconduct or bypass more appropriate tools such as summarization or tutoring skills.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.