Security audit

nature-figure

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Nature-style plotting helper, but it includes an unsafe local command template that could run unintended shell commands if used with an untrusted file path.

Review this skill before installing. Avoid using the auto-figure command with untrusted or unusual file paths, verify the referenced helper script exists and is trusted, and prefer running generated Python or R code with properly validated arguments instead of interpolating user input into a shell command.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Shell Command Injection Through Unquoted User-Controlled Arguments
Content: View full analysis
\ --output ~/Downloads/figure_.pdf \ --title "[figure title]" \ --xlabel "X axis label" \ --ylabel "Y axis label" \ --type [auto|line|bar|scatter|heatmap|box] ``` ### Technical Analysis The documented workflow directs the agent to replace `` with a user-provided file path and execute the resulting command through a shell. The argument is not quoted or escaped. If the supplied path contains shell control operators, command substitution syntax, whitespace, or redirection operators, the shell can interpret them as command syntax rather than as part of the filename. The `` placeholder in the output path is likewise unquoted, although it presents less direct exposure if generated exclusively from a trusted, fixed-format date source. The figure title and other arguments are shown in quotes, but safe execution still requires correct escaping if user-provided values contain quotes or command-substitution syntax. The command also invokes `auto_figure.py` from a separate Skill directory rather than from this audited project. That script was not present in the supplied artifact and therefore could not be reviewed. This expands the trust boundary and makes execution dependent on the integrity of an externally mutable local file. ### Attack Path 1. An attacker provides a purported data-file path containing shell syntax, for example: ```text data.csv; touch /tmp/command-injection-proof # ``` 2. The agent substitutes this value directly for ``. 3. The resulting shell command becomes equivalent to: ```bash python3 ~/.openclaw/workspace/skills/nature-paper-hub/scripts/auto_figure.py \ --input data.csv; touch /tmp/command-injection-proof ...[truncated 1150 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list is broad enough to activate on many generic plotting requests, not just Nature-journal figure formatting tasks. This can cause inappropriate skill routing, leading the agent to run journal-specific workflows or local helper commands when the user only asked for ordinary charting help, increasing the attack surface and risk of unintended tool use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.