ClawHub
Back to skill

Security audit

Paper Highlight

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local PDF highlighting utility with expected file writes; the main cautions are unpinned PyMuPDF installation and a few documentation mismatches.

Before installing, consider pinning PyMuPDF or using a reviewed lockfile. When running the skill, review the output and report paths, especially if using --output or --report-json, because those files may be created or overwritten. The inspected artifacts do not show hidden network access, credential use, persistence, or deceptive behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–19
Vulnerability Type: Unpinned dependency installation and uncontrolled upgrades
Risk Level: Medium

Vulnerable Code

bash
cd /Users/yo/.codex/skills/paper-highlight
uv venv .venv
source .venv/bin/activate
uv pip install pymupdf

The same unsafe installation pattern is repeated at lines 22–25 and 91–95, including an unrestricted upgrade:

bash
cd /Users/yo/.codex/skills/paper-highlight
source .venv/bin/activate
uv pip install --upgrade pymupdf

Technical Analysis

The setup instructions install PyMuPDF without a pinned version, lockfile, package hash, or other integrity constraint. Consequently, the installed code depends on whichever release the package index resolves at installation time. The unrestricted --upgrade command also permits a future release to replace the currently installed package without prior review.

Because scripts/highlight_paper.py imports fitz from PyMuPDF, compromised dependency code could execute during installation or when the script imports and uses the package. This is a supply-chain weakness rather than evidence that the current PyMuPDF package is malicious.

Attack Path

  1. An attacker compromises the dependency’s publisher account, release process, distribution infrastructure, or another relevant supply-chain component.
  2. The attacker publishes or substitutes a malicious release under the expected package identity.
  3. A user follows the documented uv pip install pymupdf or uv pip install --upgrade pymupdf instructions.
  4. The package manager resolves and installs the uncontrolled malicious release because no version or artifact hash is enforced.
  5. Malicious package behavior executes during installation or later when highlight_paper.py imports fitz.
  6. The payload operates with the privileges of the user running the installation or highlighter.

Impact Assessment

Successful exploitation could allow arbitrary code ...[truncated 477 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin PyMuPDF to a reviewed, exact version rather than resolving the latest release:

    bash
    uv pip install "pymupdf==<reviewed-version>"

  2. Define the dependency in a project configuration and commit a generated uv.lock file so installations use a reproducible resolution.

  3. Require installation from the lockfile and use hash verification or otherwise verify artifact integrity where supported.

  4. Remove the unrestricted uv pip install --upgrade pymupdf instruction. Update dependency versions only through a controlled review process that regenerates the lockfile.

  5. Run dependency vulnerability and provenance checks before accepting updates.

  6. Continue isolating the dependency in a dedicated virtual environment and execute the skill with least-privileged user permissions.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents commands that create a virtual environment, install packages, and run a script that writes annotations back to PDF files, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, that gap can let the skill perform filesystem modifications without a clear user-visible boundary, increasing the risk of unintended file writes or broader tool use than expected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Note Modes section says only default and none are valid values, and the Highlight Levels section defines extreme as the valid highest level. However, the command examples use undocumented or misspelled values such as flow, hightlight, full, and exteme. This is an intent/documentation divergence that can mislead users about what the skill actually supports.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest says the skill highlights papers by 5 semantic categories: goal, motivation, method, results, and contributions. The code also defines and supports two extra categories, "definitions" and "limitations", including colors, labels, priorities, and optional enablement, which expands the behavior beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes automatic highlighting with optional note layers, but the code's note system goes beyond simple highlighting by generating TLDR notes and section-flow explanatory annotations embedded into the PDF. This is still related to the skill's purpose, but it is a materially broader output behavior than plain semantic highlighting and should be clearly reflected in the declared behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code writes a modified PDF to disk with doc.save(...) and may also write a JSON report with write_text(...). Although the CLI arguments imply output generation, there is no confirmation prompt or explicit safety warning in code comments/docstrings near the write operations about creating or overwriting user files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.