ClawHub
Back to skill

Security audit

Document Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill matches an academic paper workflow, but its scripts handle remote paper archives and paths unsafely enough to risk local file reads or writes outside the intended folders.

Review before installing. Use this only in a contained workspace and avoid running it on untrusted or arbitrary paper sources until archive extraction, LaTeX include resolution, and download destination validation are fixed. Also be aware that search terms go to external providers and the package contains a bundled Semantic Scholar API key.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/latex_reader.py:64
Finding

Unsafe Extraction of Untrusted arXiv Archives

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/latex_reader.py:453
Finding

Untrusted LaTeX Include Directives Can Read Local Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_paper.py:56
Finding

Unsanitized Theme Permits Download Destination Escape

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search_papers.py:43
Finding

Hard-Coded Semantic Scholar API Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/search_papers.py (reported line 54)May include surrounding context.

python
req = urllib.request.Request(url, headers={"x-api-key": api_key, "Accept": "application/json"})
    
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            data = json.loads(response.read().decode())
            papers = [_format_paper(p) for p in data.get("data", [])]
            # Filter papers with PDF URLs (check for non-empty string) and return top results

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
| `latex_reader.py` | Download LaTeX source (for AI reading) |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases such as "download paper," "paper summary," and especially "read paper," which can match many ordinary user requests outside the narrow arXiv/LaTeX workflow. This can cause unintended activation of the skill, leading the agent to invoke external search/download behavior or apply the wrong workflow when the user did not intend it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script embeds a hardcoded default Semantic Scholar API key and automatically transmits it on outbound requests. Hardcoded credentials are dangerous because they can be extracted from source control or redistributed artifacts, abused by unauthorized parties, and make key rotation and accountability difficult.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_papers.py (reported line 46)May include surrounding context.

python
api_key = os.environ.get("SEMANTIC_SCHOLAR_API_KEY", "g7Rh7ivl2o8mxhyjTvNhUDXyrD6VuUw5PgrjZqD7")
    # Request openAccessPdf field to filter papers with PDF
    fields = "paperId,title,abstract,year,venue,citationCount,authors,url,openAccessPdf"
    url = f"https://api.semanticscholar.org/graph/v1/paper/search?query={urllib.parse.quote(query)}&limit={max_results * 2}&fields={fields}"  # Get more to filter
    
    if year_from:
        url += f"&year={year_from}-{year_to if year_to else year_from}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search_papers.py (reported line 98)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=30,
            encoding='utf-8', errors='replace',
            creationflags=subprocess.CREATE_NO_WINDOW if sys.platform == 'win32' else 0

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The code performs networked paper searches using external providers, transmitting the user-supplied query off the local system. While there are informational logs indicating which provider is used, there is no warning that user input will be shared with third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.