Security audit

Huo15 Research Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese-language research assistant that calls an OpenClaw LLM, saves markdown outputs locally, and has some documentation overstatement but no hidden or destructive behavior.

Install only if you are comfortable sending research topics and generated notes to your configured OpenClaw LLM provider and having outputs persisted under your OpenClaw knowledge-base path. Treat Obsidian integration as optional/manual rather than guaranteed, and avoid using confidential or proprietary research topics unless your environment is approved for that data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill documentation advertises a full 6-phase autonomous research pipeline with human-in-the-loop checkpoints and Obsidian output, but the static finding indicates the implementation does not match those claims. This is dangerous because users may grant trust, provide sensitive research topics, or approve execution under false assumptions about oversight, storage destination, and workflow completeness, leading to unintended disclosure or unsafe automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad everyday phrases such as research-related natural language, which can cause accidental invocation in unrelated conversations. Unintended activation is risky because the skill may begin network searches, generate files, or process sensitive user topics without a deliberate opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill performs literature discovery and declares dependencies like curl for web search, but it does not clearly warn that research topics may be sent to external services. This can expose sensitive or proprietary subjects to third parties, especially in enterprise or unpublished research contexts where topic confidentiality matters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill writes research artifacts to a local path and may also write into Obsidian, but the description does not prominently warn users about these persistence behaviors. This is dangerous because users may enter confidential research ideas, proprietary topics, or personal notes without realizing they will be stored on disk in a predictable location.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sends the user-supplied topic and, in later phases, accumulated research content to an external LLM service via openclaw llm generate without any consent, warning, redaction, or data-classification check. In a research workflow, users may include unpublished ideas, proprietary data, or sensitive notes, so silent transmission to a third party creates a real confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Multiple prompts explicitly require Chinese output, and the final paper generation also mandates Chinese as the primary language. This is a natural-language locale policy constraint, but the script does not offer opt-in, configuration, or justification for restricting output language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script contains a natural-language instruction requiring the model to respond in Chinese: "请用中文输出". Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction "请用中文输出" mandates a specific language for the skill's output. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt explicitly instructs the model to '请用中文输出', which imposes a specific language on all outputs. This is a natural-language policy issue because the file does not offer user opt-in or explain a justified locale-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction "请用中文输出" forces a specific language for all outputs. Under the policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction 请用中文撰写主要部分，英文标题和关键词 imposes a specific language choice in the generated output without offering the user a language or locale option. This is a natural-language policy concern because it constrains output language by default rather than making it configurable or clearly justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest description says the pipeline '输出到Obsidian', which implies Obsidian is the main output destination. In code, all phase outputs are written under $HOME/.openclaw/... as markdown files, while Obsidian integration is explicitly optional and limited to a best-effort command plus a manual import hint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code performs a file write to "$OUTPUT_FILE" via shell redirection, but the script provides no prior warning, confirmation, or explanatory comment/docstring about overwriting or creating files. For code files, file writes can be safety-relevant when they lack any disclosure to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script performs a file write operation by redirecting content into the path supplied by OUTPUT_FILE. There is no confirmation prompt, overwrite warning, or explanatory comment/docstring indicating that the target file will be created or replaced, so users may not realize the script modifies filesystem state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs a file write with echo "$PAPER_PROMPT" > "$OUTPUT_FILE", but there is no prior warning, confirmation, or explanatory comment/docstring disclosing that the target file will be overwritten. The only visible message appears after the write completes, so users are not informed before the potentially destructive operation occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.