ClawHub
Back to skill

Security audit

Deepxiv Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent academic-paper research helper, with the main caution that installing its external CLI pulls an unpinned Python package.

Install only if you trust the deepxiv-sdk package source, and prefer a pinned, reviewed version where possible. Expect the skill to contact literature, web-search, or LLM services when using the corresponding commands, and approve any install or LLM-agent cost before proceeding.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/install.md:14
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
" ``` 2. Publish the expected package version, official repository, package index, artifact filename, and SHA-256 checksum in the installation documentation. 3. Prefer installation from a locked dependency manifest containing cryptographic hashes. Where standard `pip` is used, enforce hash verification: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Explicitly select the trusted package index and disable unexpected fallback indexes where operationally appropriate: ```bash python3 -m pip install \ --index-url https://pypi.org/simple \ --no-deps \ --require-hashes \ -r requirements.lock ``` 5. Audit the pinned `deepxiv-sdk` artifact and its transitive dependencies before documenting it as approved. Repeat the audit before updating the pin. 6. Prefer prebuilt, verified wheels and reject unexpected source distributions where feasible, reducing exposure to package build-time code. 7. Retain the existing requirement for explicit user approval and show the exact version, source, and checksum to the user before installation. 8. Keep installation isolated through `pipx` or a dedicated virtual environment, run it without administrative privileges, and avoid placing secrets in the installation or runtime environment. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md
See `references/workflows.md` for fuller versions of these.

## Output rules

- Always say which **rung** of the ladder informed your conclusion (e.g. "based on `--brief` only" vs. "after reading the Method section")
- Do not make section-level claims you didn't actually read

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 19)May include surrounding context.

Linux — Debian / Ubuntu

bash
sudo apt update && sudo apt install -y pipx
pipx install deepxiv-sdk

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The recommended workflow examples are written as direct user utterances in Chinese only, such as "帮我找最近关于 agent memory 的论文" and "本周热门论文", with no accompanying note that the skill is multilingual or that Chinese is merely illustrative. This can violate language/locale policy by implying a fixed language experience without user opt-in or justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 19)May include surrounding context.

Linux — Debian / Ubuntu

bash
sudo apt update && sudo apt install -y pipx
pipx install deepxiv-sdk

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 26)May include surrounding context.

Linux — Debian / Ubuntu

bash
sudo apt update && sudo apt install -y pipx
pipx install deepxiv-sdk

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 33)May include surrounding context.

Linux — Debian / Ubuntu

bash
sudo apt update && sudo apt install -y pipx
pipx install deepxiv-sdk

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file explicitly says to use the workflow when the user wants "热门论文 / 趋势综述 / 每周论文速递," and similar Chinese-language trigger phrasing appears again later. This embeds a language-specific policy in the skill instructions without indicating that users may choose another language or that the locale restriction is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instruction says to use the workflow when the user wants "对比不同论文的方法 / 数据集 / 指标 / 成绩," which again hard-codes Chinese-language trigger wording. Because no opt-in or multilingual guidance is given, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The phrase "高影响力" is mixed into the invocation guidance for this workflow, continuing the pattern of locale-specific trigger descriptions. The file does not explain that the skill is region-specific or let the user choose language, so this violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.