arxiv-skill-hunter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:14 PM UTC
• Version: 1.0.0

Overview

This skill openly generates arXiv-based Node.js skills, but it turns external paper content into persistent runnable skills and memory entries without visible review or containment.

Use this only in a disposable or tightly reviewed workspace. Treat generated skills as untrusted code until manually inspected, keep credentials out of the runtime environment, and prefer pinned dependencies plus a lockfile before installation.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: index.js:35

Finding

Untrusted External Metadata Can Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:35

Finding

Untrusted Paper Content Is Passed Directly to a Runnable-Skill Generator

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation describes execution and outputs but does not clearly warn that running it will mutate local state by writing memory/evolution/pending_skill_task.json and generate new executable skill files under skills/arxiv-learned-*. In a system that auto-runs or chains skills, undocumented file creation increases the risk of surprise persistence, unintended downstream execution, and unsafe trust in generated code.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency uses a caret range instead of an exact version, allowing different installs to resolve to different releases over time. This weakens build reproducibility and can silently introduce vulnerable or malicious upstream changes into the skill's execution environment.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"author": "OpenClaw",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "glob": "^10.3.10"
  }

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

Axios has multiple known advisories, and because the manifest does not pin the exact installed version, it is impossible to verify from this file whether the resolved package is patched. In a skill that fetches remote content from arXiv or other external sources, an affected HTTP client could increase exposure to SSRF, proxy bypass, or response-manipulation issues depending on how the library is used elsewhere.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The glob dependency is specified with a caret range, so future installs may pull newer compatible releases without explicit review. This creates supply-chain risk and reduces reproducibility, especially for an automation-focused skill that may be deployed repeatedly in different environments.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "glob": "^10.3.10"
  }
}

Unverifiable Dependency: glob has 1 known advisory(ies) (CVE-2025-64756 (glob CLI: Command injection via -c/--cmd executes matches with shell:true)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 71% confidence

Finding

Glob has a known advisory affecting CLI command execution behavior, and the unpinned manifest prevents verification that a safe version is installed. The risk is somewhat contextual because the advisory targets CLI usage, but unpinned dependency resolution still leaves uncertainty and avoidable supply-chain exposure.

Content

No source excerpt is available for this finding.