ClawHub
Back to skill

Security audit

Literature Report

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent literature-reporting automation that uses expected network and LLM access, but users should protect API keys and review scheduled execution before enabling it.

Install only if you are comfortable sending paper titles, abstracts, and research-focus text to your chosen LLM provider. Use a trusted HTTPS base_url, keep config.yaml out of source control, prefer a virtual environment and a limited-spend API key, and review any cron entry before enabling daily runs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/llm_client.py:21
Finding

Configurable LLM endpoint can expose API credentials and research content

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
install.sh:22
Finding

Installer resolves unpinned dependencies and suppresses installation failures

Content
View full analysis
&1 | grep -v "WARNING\|DEPRECATION" || true echo "安装可选依赖（PDF生成）..." pip3 install -q markdown weasyprint 2>&1 | grep -v "WARNING\|DEPRECATION" || true ``` The metadata only specifies lower bounds and therefore does not make installation reproducible: ```json "dependencies": [ "feedparser>=6.0.0", "requests>=2.25.0", "pyyaml>=5.4.0", "markdown>=3.3.0", "weasyprint>=52.0" ] ``` ### Technical Analysis The installer invokes `pip3` without exact versions, hashes, a lock file, or an isolated virtual environment. Every installation can therefore resolve a different current release and a different transitive dependency graph. Python package installation may execute package build logic during installation. If a future direct or transitive dependency release is compromised, the altered package can execute with the privileges of the user running `install.sh`. The pipeline additionally ends with `|| true`. This suppresses errors from the pip-and-grep pipeline, after which the script prints that dependency installation completed successfully. This can leave a partial or unexpected environment while misleading the user about installation status. No evidence shows that the currently named packages are malicious. The finding concerns the unsafe and non-reproducible dependency acquisition process. ### Attack Path 1. A direct dependency or one of its transitive dependencies publishes a compromised release, or its package-distribution account is compromised. 2. The victim runs `bash install.sh` after that release becomes eligible for dependency resolution. 3. Unpinned `pip3 install` resolves the compromis ...[truncated 880 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The documented purpose does not mention that the skill may inspect local config files, validate API keys, and test external connectivity as primary behaviors. Those actions touch sensitive configuration and potentially transmit data externally, so failing to disclose them accurately creates a meaningful security and privacy risk even if the intent is not malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose does not mention that the skill may inspect local config files, validate API keys, and test external connectivity as primary behaviors. Those actions touch sensitive configuration and potentially transmit data externally, so failing to disclose them accurately creates a meaningful security and privacy risk even if the intent is not malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose does not mention that the skill may inspect local config files, validate API keys, and test external connectivity as primary behaviors. Those actions touch sensitive configuration and potentially transmit data externally, so failing to disclose them accurately creates a meaningful security and privacy risk even if the intent is not malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose does not mention that the skill may inspect local config files, validate API keys, and test external connectivity as primary behaviors. Those actions touch sensitive configuration and potentially transmit data externally, so failing to disclose them accurately creates a meaningful security and privacy risk even if the intent is not malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose does not mention that the skill may inspect local config files, validate API keys, and test external connectivity as primary behaviors. Those actions touch sensitive configuration and potentially transmit data externally, so failing to disclose them accurately creates a meaningful security and privacy risk even if the intent is not malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide instructs users to place an API key and Feishu user identifier into a configuration file and to send generated report content to external services, but it provides no warning about credential handling, file permissions, secret storage, redaction, or data-sharing implications. In a skill that automates retrieval, summarization, and third-party delivery, this omission increases the chance of credential leakage or unintentional transmission of sensitive research topics or outputs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The guide recommends setting up a persistent cron job that repeatedly executes scripts performing network retrieval and automated processing, but it does not mention safe execution context, least-privilege accounts, logging hygiene, or how to remove/disable the task. Persistent scheduled execution raises risk because misconfiguration or later script compromise would continue to run automatically and could repeatedly exfiltrate data or misuse stored credentials.

Content

Scanner excerpt · GUIDE.md (reported line 61)May include surrounding context.

方法2：使用系统cron

bash
crontab -e
# 添加以下行（每天早上9点执行）
0 9 * * * cd /path/to/research && python3 scripts/fetch_papers.py && python3 scripts/generate_summary.py

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown states the skill supports '自动推送' and later shows a send_to_feishu.py step, but it does not warn users that generated report content may be transmitted to Feishu or other external services. For a markdown file, omitting privacy or data-transfer disclosure for behavior that could affect user data matches the missing user warnings category.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documentation declares installation, shell execution, network access, local file reads/writes, and scheduling, but it does not define any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow the skill to run with broader capabilities than users expect, increasing the blast radius for unintended file modification, command execution, or network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad activation phrases like '设置文献汇报' or '每天推送论文' can overlap with ordinary conversation and trigger the skill unexpectedly. In a skill that can invoke shell commands, read/write files, and use network resources, accidental activation increases the chance of unintended execution and unreviewed credential use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly instructs users to send paper titles/abstracts and API-backed prompts to an external LLM endpoint, which constitutes external data transmission. In this context the transmission is part of the intended function, but it still creates privacy, confidentiality, and supply-chain risk because research topics, paper content, and potentially metadata leave the local environment and depend on a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
# LLM API配置（必须）
api:
  api_key: "YOUR_API_KEY"        # 你的LLM API Key
  base_url: "https://api.siliconflow.cn/v1"  # API基础URL
  model: "deepseek-ai/DeepSeek-V3.2"  # 模型名称

# 推送配置（可选）

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states the skill is an '自动科研文献汇报系统' and specifically produces '双语摘要', but all user-facing metadata is presented in Chinese with no indication that language or locale is configurable. This creates a natural-language locale policy concern because the skill appears to impose a specific language context without explicit user opt-in or justification as a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module documentation and prompt content require Chinese-language behavior, including a Chinese-only output format and default Chinese research focus. There is no opt-in, alternative locale handling, or explanation that this is intentionally restricted to a Chinese-language workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code performs an outbound network request to a configurable external endpoint using an API key and user/content-derived prompt data. External transmission is expected for an LLM integration, but it still creates a real security boundary crossing: data leaves the local environment, and if the configured base URL is untrusted or misconfigured, sensitive content could be exposed to unintended recipients.

Content

Scanner excerpt · scripts/ai_filter.py (reported line 52)May include surrounding context.

python
}
    
    try:
        response = requests.post(
            f"{base_url}/chat/completions",
            headers=headers,
            json=data,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends paper titles and abstracts to an external LLM service, but there is no evidence of user notice, consent, or data-classification checks before transmission. Even if papers are public, abstracts, custom research topics, or future inputs may contain sensitive or proprietary information, creating privacy and compliance risk when routed to a third-party API.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Untrusted paper titles and abstracts are interpolated directly into the LLM prompt, so malicious paper text can include prompt-injection instructions that manipulate the model's relevance judgment. In this skill, that can poison filtering results, causing irrelevant or adversarial content to be selected, trusted, and potentially pushed downstream into summaries or notifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This Python file contains natural-language docstrings and error/help text exclusively in Chinese, including the module description and remediation guidance. Under the policy rule for language/locale, forcing a specific language without opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains natural-language descriptions and runtime messages exclusively in Chinese, beginning with the module docstring and continuing throughout the script. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest says the skill activates when users want to customize research topics, implying topic selection should be user-driven. In this file, both the keyword filter and the AI screening focus are fixed to a specific domain ('医疗设备相关研究'), so the implemented behavior is narrower than the claimed general custom-topic literature reporting capability.

Content

No source excerpt is available for this finding.

Tainted flow: 'params' from requests.get (line 175, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fetch_papers.py (reported line 160)May include surrounding context.

python
'sort': 'pub_date',
        }
        
        response = requests.get(search_url, params=params, timeout=30)
        data = response.json()
        
        if 'esearchresult' not in data:

Tainted flow: 'params' from requests.get (line 175, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fetch_papers.py (reported line 181)May include surrounding context.

python
'retmode': 'xml',
        }
        
        response = requests.get(fetch_url, params=params, timeout=30)
        
        # 简单解析XML（只提取标题和摘要）
        import xml.etree.ElementTree as ET

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The docstring states in Chinese that the script generates summaries and key findings and specifically generates a Chinese title, suggesting a fixed language behavior. There is no visible indication that users can opt into another language or that the Chinese-language requirement is explicitly justified as a region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends paper titles and abstracts to external LLM functions without any visible consent, disclosure, data-classification check, or sanitization step. While literature metadata is often public, abstracts can still be licensed, sensitive in some workflows, or contain unpublished/internal content if upstream inputs are modified, so silent transfer to a third-party API creates a real data-governance and privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This is a concrete external transmission path: the skill posts prompt data containing paper content to a configurable remote endpoint. Because the destination is taken from configuration and there are no restrictions shown on scheme, host allowlisting, or data sensitivity checks, the skill could disclose user-provided or collected content to an unintended third party.

Content

Scanner excerpt · scripts/llm_client.py (reported line 52)May include surrounding context.

python
}
    
    try:
        response = requests.post(
            f"{base_url}/chat/completions",
            headers=headers,
            json=data,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code sends paper titles and abstracts embedded in prompts to an external LLM endpoint via HTTP without any visible consent flow, notice, redaction, or data-classification guard. In a literature-reporting skill, abstracts may include unpublished, proprietary, or subscription-restricted content, so silent third-party transmission creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.