T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scholar-search.py:469- Finding
Arbitrary Local Python Script Execution Through the QQBot Staging Option
- Content
View full analysis
- Remediation
View remediation
Security audit
Research Papers
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does academic paper search as described, but its optional QQBot handoff can execute a caller-selected local Python script.
Review the QQBot handoff before installing. The search and review features are coherent, but avoid using --qqmedia or --stage-media-script unless the staging script path is trusted and package-owned; a malicious local script at that path would run with the agent's normal user privileges.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises and demonstrates shell, network, file read/write, and possible environment access, but does not declare any explicit tool scope or permissions boundaries. This creates an authorization and least-privilege gap: a caller or orchestrator may allow broader execution than intended, including network access, local file writes, and staging files for external handoff.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description instructs the system to assume a default research context for vague requests, which broadens the skill's applicability beyond explicit user intent. In combination with network access, shell commands, downloads, and file generation, this can trigger external actions or data retrieval without sufficiently clear user direction.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance uses broad triggers such as requests for papers, related work, recent methods, baselines, or literature reviews, which can cause the skill to activate for loosely related prompts. Over-broad invocation increases the chance that a higher-privilege skill is selected when a simpler or safer response would suffice, exposing unnecessary network, shell, and file capabilities.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
The instruction not to ask the user to repeat the research direction pushes the skill toward autonomous interpretation of intent. While not overtly malicious, this reduces user confirmation and can lead to the system initiating searches, downloads, or generated review workflows based on inferred context rather than explicit authorization.
- Content
md - Spatiotemporal attention and temporal-spatial interaction - Cross-time-slice dynamic brain state modeling Do not ask the user to repeat this research direction unless the request is ambiguous across fields. ## Query Expansion Rules
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python BASE = "https://api.openalex.org" UNPAYWALL_BASE = "https://api.unpaywall.org/v2" MAILTO = os.getenv("OPENALEX_MAILTO", "openclaw@example.com") APP_DIR = Path.home() / ".openclaw" / "scholarly-research"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This helper invokes an external script unrelated to the core API-search logic, expanding the attack surface beyond literature review generation. Because the helper path is discoverable from environment variables or user-provided arguments, the feature can be abused to execute attacker-controlled code under the guise of media staging.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 92% confidence
- Finding
The code executes another Python script whose path can come from CLI input or environment variables, creating a trust boundary violation. Although subprocess.run is used without shell=True, a malicious or substituted stage_media.py would run arbitrary code with the current user's privileges whenever --qqmedia is used.
- Content
python "or pass --stage-media-script." ) result = subprocess.run( [sys.executable, str(script), str(source)], capture_output=True, text=True,
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest emphasizes searching papers, DOI lookup, citation analysis, PDF discovery/download, and literature review generation, but does not mention persistent local storage. The code creates application directories, caches network responses, and writes generated reviews to disk, which is additional behavior beyond the described user-facing scope.
- Content
Static analysis
No suspicious patterns detected.