ClawHub
Back to skill

Security audit

Academic paper reading, summarizing, polished method diagrams drawing SKILL

Security checks for vulnerabilities and agentic risk

Overview

This skill analyzes research papers and optionally creates diagram files, with its file output and rendering behavior disclosed and aligned with that purpose.

Install this if you want paper reviews saved as files and optional diagram artifacts. Be aware that arXiv links may be fetched, report files are written by default, and PNG diagram generation may use a local browser renderer and Google Fonts in the generated HTML.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are very broad and auto-invoke on common paper-related phrases or whenever paper content is merely present, without meaningful exclusion criteria. Over-broad activation can cause the skill to process unintended content, fetch external resources such as arXiv HTML, or generate files when the user did not explicitly ask for this workflow, increasing the chance of unauthorized actions and data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes instructions to invoke Playwright and, if unavailable, fall back to headless Chromium or wkhtmltopdf for rendering diagrams. These subprocess/browser-rendering paths extend beyond core paper analysis and can increase attack surface through local file rendering, network font fetching, and execution of external binaries, especially if any part of the rendered HTML is influenced by untrusted paper or user content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions state that when the user uses Chinese, the analysis must use the file's Chinese section titles and output format, and that the content should be entirely in Chinese. This imposes a language policy based on detected user language rather than offering a choice, which matches the locale/language policy violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The text says the skill will '默认...写出英文 Markdown 报告' unless the user specifies another language. This imposes a default language preference rather than offering a neutral choice or explicit opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest emphasizes analyzing, summarizing, critiquing, and optionally visualizing papers, but does not mention persistent file creation as a required behavior. The code documentation makes disk writes mandatory for every run, which is a behavioral expansion beyond the user-facing description rather than a clearly implied implementation detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The flags specify --lang values en, cn with default en, which imposes a specific output language by default. Because the file does not present language choice neutrally at invocation time except for Chinese-detection special handling, this may conflict with policies requiring user language/locale choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document root sets lang="en", which hard-codes English as the page language. Under the policy rules, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

These lines prescribe mandatory locale-specific formatting such as Chinese punctuation and Arabic numeral usage using directive language like '优先使用' and '始终使用'. While the file is intended for Chinese labels, this section sets presentation policy without explicitly offering user choice or clarifying that these are optional style recommendations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.