ClawHub
Back to skill

Security audit

Overleaf LaTeX

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Overleaf LaTeX workflows, but it asks users to persist credentials in plaintext and install an unpinned third-party plugin.

Install only if you are comfortable with Overleaf project access, local git pushes, and local LaTeX compilation. Prefer a revocable Overleaf token over a password, avoid git credential.helper store globally, and treat the suggested plugin install as separate executable code that should be pinned or reviewed before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Plugin Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–20
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## OpenClaw Plugin Available

For full agent tool integration (6 native tools: overleaf_clone, overleaf_branch, overleaf_compile, overleaf_push, overleaf_status, overleaf_health), install the Overleaf plugin:

```bash
openclaw plugins install clawhub:@wahajahmed010/openclaw-overleaf
text

### Technical Analysis

The Skill directs users to install an executable third-party plugin from ClawHub without specifying an immutable version, commit, or integrity checksum. The plugin's source code is not included in the audited project, so the behavior of its six native tools cannot be verified from this artifact.

Because the package reference is mutable, code retrieved when the command is executed may differ from the code that existed when the Skill was reviewed. Compromise of the publisher account, package registry, or plugin release process could consequently introduce malicious code into an otherwise trusted workflow.

### Attack Path

1. An attacker compromises the plugin publisher account, the ClawHub package, or its release pipeline.
2. The attacker publishes a malicious update under the referenced package name.
3. A user follows the Skill instructions and executes the unpinned installation command.
4. OpenClaw retrieves and installs the current malicious package version.
5. The plugin executes with the permissions available to the OpenClaw process and its native tools.
6. The malicious plugin can attempt to access local files, credentials, Overleaf projects, Git repositories, or other resources available to that process.

### Impact Assessment

Successful exploitation could provide access equivalent to the OpenClaw process executing the plugin. Depending on the host configuration and granted tool permissions, the affec
...[truncated 317 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the plugin to a specific, previously audited immutable version.
  • Verify the package with a publisher signature, cryptographic checksum, or equivalent integrity mechanism before installation.
  • Include the plugin source and dependency lock data in the security-review scope.
  • Document the plugin's required permissions and restrict it to the minimum filesystem, credential, network, and Agent-tool capabilities needed.
  • Use an approved internal registry or vetted package allowlist where possible.
  • Establish an update-review process rather than automatically trusting later package releases.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:54
Finding

Plaintext Global Git Credential Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–59
Vulnerability Type: Plaintext sensitive-data storage and overly broad configuration scope
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### 3. Configure git credential helper

```bash
# Store credentials so you don't get prompted
git config --global credential.helper store
text

### Technical Analysis

Git's `store` credential helper persists credentials without encryption, normally in `~/.git-credentials`. File permissions can limit direct access, but the stored values remain recoverable as plaintext by the account owner, processes running under that account, malware with user-level access, or an attacker who obtains the user's files.

The command also applies the helper globally rather than limiting it to Overleaf. As a result, credentials entered for unrelated Git services may also be persisted using the plaintext helper. This broadens the exposure beyond the workflow described by the Skill.

### Attack Path

1. A user runs `git config --global credential.helper store` as instructed.
2. The user authenticates to Overleaf or another HTTPS Git service.
3. Git writes the supplied username and password or token to its plaintext credential store.
4. A malicious process, local attacker with access to the account, compromised backup, or information-stealing malware reads the credential file.
5. The attacker extracts and reuses any still-valid credentials against the corresponding Git services.
6. The attacker accesses or modifies repositories within the permissions granted to the stolen credentials.

### Impact Assessment

Exploitation can expose Overleaf credentials or access tokens and potentially credentials for unrelated Git hosts because the setting is global. The resulting privileges are limited to those granted by each recovered credential, but they may include reading private projects, cloning repositories, pushing unau
...[truncated 234 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to use Git's plaintext store helper.
  • Use an operating-system-backed credential manager such as Git Credential Manager, macOS Keychain, or libsecret.
  • Prefer narrowly scoped, revocable, short-lived personal access tokens instead of account passwords.
  • Limit credential-helper configuration to the relevant repository or Overleaf host rather than applying it globally.
  • Apply the least privileges available to Overleaf tokens and rotate any credentials previously saved in plaintext.
  • Delete exposed entries from ~/.git-credentials, verify restrictive permissions on remaining credential files, and review backups or logs that may contain copied credentials.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill instructs users to place an Overleaf personal access token in a local file, creating a clear credential-handling surface. Even though tokens are recommended over passwords, storing reusable secrets in plaintext on disk can lead to compromise through local malware, overly broad filesystem access, backups, or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

chmod 600 ~/.openclaw/.overleaf_credentials

text

Or use a personal access token (recommended):

```bash
echo "OVERLEAF_EMAIL=your@email.com" > ~/.openclaw/.overleaf_credentials

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent/user to perform shell commands and file writes, including creating credential files and configuring git, but the manifest does not declare any tool scope or permission boundaries. This increases the chance of unintended command execution or file modification if the skill is auto-invoked, because consumers cannot clearly see or constrain what capabilities the skill expects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description contains broad triggers such as 'latex', 'overleaf', and 'resume version', which can cause the skill to activate in contexts that do not actually require credential handling, shell access, or git operations. Overbroad activation is risky here because the skill includes sensitive setup steps and command execution guidance that could be surfaced or run unnecessarily.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
The skill below covers the manual workflow. The plugin provides the same functionality as native agent tools.

Manage Overleaf LaTeX projects through git integration. Clone projects, create branches for tailored versions, edit LaTeX, compile locally, and push back.

## Prerequisites

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly tells users to store Overleaf credentials in a local plaintext file and configure git to persist credentials, but it does not provide a strong warning about the security implications of local secret storage and credential caching. This is dangerous because plaintext secrets may be exfiltrated by other local processes, backups, or accidental inclusion in logs, and git credential persistence can retain reusable authentication material beyond the immediate task.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Create credentials file

echo "OVERLEAF_EMAIL=your@email.com" > ~/.openclaw/.overleaf_credentials echo "OVERLEAF_PASSWORD=your_password_or_token" >> ~/.openclaw/.overleaf_credentials chmod 600 ~/.openclaw/.overleaf_credentials

text

Or use a personal access token (recommended):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Create credentials file

echo "OVERLEAF_EMAIL=your@email.com" > ~/.openclaw/.overleaf_credentials echo "OVERLEAF_PASSWORD=your_password_or_token" >> ~/.openclaw/.overleaf_credentials chmod 600 ~/.openclaw/.overleaf_credentials

text

Or use a personal access token (recommended):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt-get install -y texlive-latex-base texlive-latex-extra texlive-fonts-recommended

# macOS
brew install --cask mactex

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
perms = oct(os.stat(CREDENTIALS_PATH).st_mode)[-3:]
    if perms != "600":
        print(f"   WARN: {CREDENTIALS_PATH} has permissions {perms}, expected 600")
        print(f"   Run: chmod 600 {CREDENTIALS_PATH}")
    
    with open(CREDENTIALS_PATH) as f:
        lines = f.read().strip().splitlines()

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/overleaf_health.py (reported line 31)May include surrounding context.

python
perms = oct(os.stat(CREDENTIALS_PATH).st_mode)[-3:]
    if perms != "600":
        print(f"   WARN: {CREDENTIALS_PATH} has permissions {perms}, expected 600")
        print(f"   Run: chmod 600 {CREDENTIALS_PATH}")
    
    with open(CREDENTIALS_PATH) as f:
        lines = f.read().strip().splitlines()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/overleaf_health.py (reported line 51)May include surrounding context.

python
def check_git_overleaf():
    """Check that git can reach overleaf.com."""
    print("2. Checking git.overleaf.com connectivity...")
    result = subprocess.run(
        ["git", "ls-remote", "https://git.overleaf.com/", "HEAD"],
        capture_output=True, text=True, timeout=10
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/overleaf_health.py (reported line 69)May include surrounding context.

python
print("3. Checking pdflatex...")
    pdflatex_path = shutil.which("pdflatex")
    if pdflatex_path:
        result = subprocess.run(["pdflatex", "--version"], capture_output=True, text=True)
        version_line = result.stdout.splitlines()[0] if result.stdout else "unknown"
        print(f"   OK: {version_line}")
        return True

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/overleaf_health.py (reported line 75)May include surrounding context.

python
return True
    else:
        print("   FAIL: pdflatex not found in PATH")
        print("   Install: sudo apt-get install -y texlive-latex-base texlive-latex-extra texlive-fonts-recommended")
        return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/overleaf_health.py (reported line 92)May include surrounding context.

python
with open(tex_path, "w") as f:
            f.write(latex_content)
        
        result = subprocess.run(
            ["pdflatex", "-interaction=nonstopmode", "-output-directory", tmpdir, tex_path],
            capture_output=True, text=True, timeout=30
        )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The line states 'Date format — DD.MM.YYYY (European)' as a blanket instruction, which imposes a locale-specific formatting policy in natural language. Because the file does not explicitly limit this requirement to users targeting the German market context on that line or offer user choice, it can be read as forcing a locale convention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.