ClawHub
Back to skill

Security audit

Automatically search for literature on environmental psychology

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate academic-paper workflow, but its automatic third-party PDF downloading and CSV export handling need review before installation.

Install only if you are comfortable with DOI lookups being sent to Unpaywall and with the tool downloading files from URLs returned by a third-party API. Use a dedicated virtual environment and a limited output folder, review generated CSV files as untrusted data, and avoid running it on sensitive networks until URL validation, download size limits, PDF validation, and pinned dependencies are added.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wos_downloader.py:169
Finding

Unvalidated External PDF URL Enables Server-Side Request Forgery and Unbounded Downloads

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wos_downloader.py:246
Finding

Spreadsheet Formula Injection in Exported Metadata CSV

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Unbounded and Unverified Third-Party Dependency Resolution

Content
View full analysis
=2.28.0 pandas>=1.5.0 ``` The documented installation command is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Both dependencies specify only minimum versions. An installation can therefore resolve to any future release accepted by the environment. The project supplies no lock file, upper bounds, package hashes, or recorded transitive dependency set. This makes installations non-reproducible and prevents users from verifying that they are installing the same dependency artifacts reviewed by the project author. If a future direct or transitive release is compromised, malicious installation or runtime behavior could enter the environment without any change to this repository. The executable imports `requests` but does not import or use `pandas`. Retaining an unused, large dependency unnecessarily expands the transitive dependency graph and supply-chain attack surface. ### Attack Path 1. A user follows `SKILL.md` and runs `pip install -r scripts/requirements.txt`. 2. Pip queries the configured package index and resolves the newest compatible direct and transitive packages available at that time. 3. A compromised future release, compromised package-index account, or malicious package served through an untrusted configured index satisfies the lower-bound constraint. 4. The package is installed into the user's Python environment. 5. Malicious package installation hooks or imported runtime code execute with the privileges of the user running pip or the Skill. ### Impact Assessment A compromised dependency can execute code with the permissions of the installation or runtime process. This may allow access to files, environment variables, credentials available to that user, and network resource ...[truncated 288 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented behavior claims automated Web of Science search, metadata extraction, and PDF download assistance, while the referenced implementation is reportedly only a placeholder script. This mismatch is dangerous because users and reviewers may grant trust, permissions, or credentials to a skill under false assumptions, enabling later bait-and-switch behavior or unsafe operation without adequate scrutiny.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises behaviors involving browser automation, network access, and local file output, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file and network access, reducing reviewability and increasing the risk of unintended data exposure or unsafe automation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/doi_resolver.md (reported line 9)May include surrounding context.

API 端点

text
https://api.unpaywall.org/v2/{doi}?email={your_email}

响应字段

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/doi_resolver.md (reported line 60)May include surrounding context.

Crossref API

获取文献元数据：

text
https://api.crossref.org/works/{doi}

DOI.org

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file’s natural-language content, including the module docstring and later CLI/help text, is written entirely in Chinese, which imposes a specific language on users. The file does not offer any language selection, fallback, or explanation that the tool is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The script transmits user-supplied DOI values to the external Unpaywall API, which leaks the user's research interests and paper list to a third party. In this skill's context, the paper set may reveal sensitive institutional research activity, and the hardcoded placeholder email also indicates weak handling of required API identification and privacy expectations.

Content

Scanner excerpt · scripts/wos_downloader.py (reported line 153)May include surrounding context.

python
# 清理 DOI
        doi = doi.replace('doi:', '').replace('DOI:', '').strip()
        
        url = f'https://api.unpaywall.org/v2/{doi}?email=user@example.com'
        
        try:
            time.sleep(self.delay)  # 控制请求频率

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is written entirely in Chinese and does not indicate that other languages are supported or that the user can choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file consists wholly of Chinese-language instructional content and does not provide an opt-in, alternative language, or justification for a Chinese-only locale. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specifier requests>=2.28.0 is unpinned, so installs may resolve to different versions over time, reducing reproducibility and increasing supply-chain risk. In a skill that automates web access and downloads documents, a future vulnerable or malicious package release could be pulled in without review.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0
pandas>=1.5.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

requests has multiple historical advisories, and because the manifest does not pin an exact version, it is impossible to verify from this file alone whether the installed release is affected. Given this skill's purpose—automated web searching and bulk PDF downloading—network-facing dependency flaws can be more consequential, including credential leakage or unsafe request handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency pandas>=1.5.0 is also unpinned, which creates non-deterministic builds and makes it harder to verify whether deployed environments are using secure versions. Although pandas is commonly used for data processing, leaving it floating can expose the project to avoidable supply-chain and compatibility issues.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.28.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
78% confidence
Finding

pandas has at least one advisory in its history, and the lack of exact version pinning means the actual installed package may or may not be vulnerable. In this skill, pandas is likely used for metadata processing rather than direct exposure, so the contextual danger is lower than for network libraries, but the unverifiable state remains a supply-chain weakness.

Content

No source excerpt is available for this finding.