ClawHub
Back to skill

Security audit

literature-recommendation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paper-recommendation tool, but it sends more member profile data than needed into downstream reports and LLM reranking payloads.

Review before installing in any environment with real member data. Limit the reranking payload to only the profile fields needed for matching, avoid printing full reports to orchestration logs, add prompt-injection isolation for arXiv content, and pin dependencies with a reviewed lock file. Use a least-privilege PostgreSQL account scoped to this skill's tables and an output directory with appropriate retention controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
paper_matching/pipeline.py:76
Finding

Untrusted arXiv Content Is Forwarded to an LLM Without Prompt-Injection Isolation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
paper_matching/pipeline.py:76
Finding

Reranking Payload Discloses More Member Profile Data Than Required

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · paper_matching/config.py (reported line 21)May include surrounding context.

python
def _load_environment() -> None:
    root = Path(__file__).resolve().parents[1]
    env_path = os.getenv("OPENCLAW_ENV_FILE", os.path.expanduser("~/.config/literature-recommendation/.env"))
    if load_dotenv is None:
        return
    load_dotenv(env_path, override=False)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · paper_matching/config.py (reported line 25)May include surrounding context.

python
def _load_environment() -> None:
    root = Path(__file__).resolve().parents[1]
    env_path = os.getenv("OPENCLAW_ENV_FILE", os.path.expanduser("~/.config/literature-recommendation/.env"))
    if load_dotenv is None:
        return
    load_dotenv(env_path, override=False)

Possible Typosquatting: 'psycopg' resembles popular package 'psycopg2'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.yaml (reported line 10)May include surrounding context.

yaml
required_environment_variables:
  - OPENCLAW_DB_DSN
  - OPENCLAW_OUTPUT_DIR
environment_file: ~/.config/literature-recommendation/.env

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill describes capabilities that imply network access, environment access, and database/write operations, but it does not declare any explicit tool scope or permissions boundary in the manifest. This creates a least-privilege failure: an orchestrator or reviewer cannot reliably tell what the skill is allowed to do, increasing the chance of overbroad execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list includes broad natural-language phrases such as general requests for paper recommendations, which may overlap with ordinary conversation and cause unintended invocation. In a skill that reads member preferences from PostgreSQL and performs external fetches, accidental activation can lead to unnecessary data access, network calls, and disclosure of recommendation content to downstream systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language contract specifies language: zh-CN, which mandates a specific output language. The file does not indicate that users can choose another language or that this locale restriction is optional, creating a language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language contract explicitly sets language to zh-CN and provides only Chinese instructions and examples for generated recommendation reasons. This imposes a specific language on outputs without any visible user opt-in or justification that the skill is region-specific, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This manifest description explains what the skill does, but it does not define specific invocation phrases, activation boundaries, or exclusion conditions. For a manifest file, the lack of trigger specificity can make skill routing ambiguous and increase the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill behavior in a single language without indicating that users may choose another language or locale. This can violate language/locale policy when no opt-in or justification for the restriction is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which makes builds non-reproducible and allows future vulnerable or breaking releases to be installed without review. In a skill that performs network/database-backed recommendation workflows, dependency drift can expose the runtime to supply-chain risk or unexpected security regressions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0
python-dotenv>=1.0.0
psycopg[binary]>=3.2.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest does not pin requests, so it is impossible to verify from this file alone whether deployment will use a version affected by known advisories. This is dangerous because a fresh install could silently resolve to an insecure release range or change behavior in ways that expose credentials, request handling, or TLS assumptions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

python-dotenv>=1.0.0 is unpinned, so the environment may resolve to different versions over time, including versions later found vulnerable. Because this package influences configuration and secrets loading, version drift can have security consequences beyond simple compatibility issues.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.31.0
python-dotenv>=1.0.0
psycopg[binary]>=3.2.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Because python-dotenv is not pinned, the actual installed version cannot be verified against known advisories from the manifest alone. For a skill likely to load secrets and configuration from .env files, uncertainty around package versioning increases the chance of deploying a release with unsafe file-handling behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.