Skills/ClawHub/auto-research-claw

auto-research-claw@1.0.0

BLOCKED· static only

Publisher claims: "Automates research by conducting literature searches, running experiments, and generating LaTeX papers from detailed research topics." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher donwrightdesigns · publishing for 230 daysInstalls 1,139Last detonated 25 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 39/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Auto-update or dynamic fetch configurationresearchclaw/config.py:547 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeauto_update: bool = TrueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationresearchclaw/config.py:1242 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeauto_update=bool(data.get("auto_update", True)),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsresearchclaw/experiment/ssh_sandbox.py:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 1. HOME override — prevents reading ~/.ssh, ~/.bashrc, etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directoryconfig.researchclaw.example.yaml:122 · References a credential file in the home directory# key_path: "~/.ssh/id_rsa"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedresearchclaw/agents/figure_agent/renderer.py:264 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Collapsed <details> block carrying instructionsdocs/README_DE.md:191 · Collapsed <details> block carrying instructions<summary>💡 Was unter der Haube passiert</summary> 1. OpenClaw liest `RESEARCHCLAW_AGENTS.md` → lernt die Forschungs-Orchestrator-Rolle 2. OpenClaw liest `READMFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedresearchclaw/agents/figure_agent/renderer.py:41 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationresearchclaw/experiment/runner.py:115 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeself.remote_config: SshRemoteConfig = config.ssh_remoteFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationresearchclaw/config.py:432 · Auto-update or dynamic fetch configuration — agent may load new code at runtimessh_remote: SshRemoteConfig = field(default_factory=SshRemoteConfig)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsdocs/README_JA.md:191 · Collapsed <details> block carrying instructions<summary>💡 内部で何が起きているか</summary> 1. OpenClawが`RESEARCHCLAW_AGENTS.md`を読み取り → 研究オーケストレーターの役割を学習 2. OpenClawが`README.md`を読み取り → インストールとパイプライン構造を理解 3. OpenClawが`cFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsconfig.researchclaw.example.yaml:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# key_path: "~/.ssh/id_rsa"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig.researchclaw.example.yaml:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileskey_path: "" # Path to private key (default: ~/.ssh/id_rsa)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsdocs/README_AR.md:191 · Collapsed <details> block carrying instructions<summary>💡 ماذا يحدث خلف الكواليس</summary> 1. يقرأ OpenClaw ملف `RESEARCHCLAW_AGENTS.md` → يتعلم دور منسّق البحث 2. يقرأ OpenClaw ملف `README.md` → يفهم التثبFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsdocs/README_KO.md:191 · Collapsed <details> block carrying instructions<summary>💡 내부 동작 과정</summary> 1. OpenClaw이 `RESEARCHCLAW_AGENTS.md`를 읽고 → 연구 오케스트레이터 역할을 학습 2. OpenClaw이 `README.md`를 읽고 → 설치 및 파이프라인 구조를 이해 3. OpenClaw이 `confFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Reads credential paths from the home directoryresearchclaw/experiment/ssh_sandbox.py:258 · Reads credential paths from the home directory# 1. HOME override — prevents reading ~/.ssh, ~/.bashrc, etc.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedresearchclaw/agents/figure_agent/renderer.py:337 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandresearchclaw/cli.py:692 · Privileged sudo command — agent may execute with elevated privilegesprint(" Install: sudo apt install texlive-full (or equivalent)")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsdocs/README_CN.md:191 · Collapsed <details> block carrying instructions<summary>💡 底层发生了什么</summary> 1. OpenClaw 读取 `RESEARCHCLAW_AGENTS.md` → 学习研究编排器角色 2. OpenClaw 读取 `README.md` → 理解安装方式和流水线结构 3. OpenClaw 复制 `config.researchclaw.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:190 · Collapsed <details> block carrying instructions<summary>💡 What happens under the hood</summary> 1. OpenClaw reads `RESEARCHCLAW_AGENTS.md` → learns the research orchestrator role 2. OpenClaw reads `README.mFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsdocs/README_FR.md:191 · Collapsed <details> block carrying instructions<summary>💡 Ce qui se passe en coulisses</summary> 1. OpenClaw lit `RESEARCHCLAW_AGENTS.md` → apprend le role d'orchestrateur de recherche 2. OpenClaw lit `READFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsdocs/README_ES.md:191 · Collapsed <details> block carrying instructions<summary>💡 Que sucede internamente</summary> 1. OpenClaw lee `RESEARCHCLAW_AGENTS.md` → aprende el rol de orquestador de investigacion 2. OpenClaw lee `README.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsconfig.researchclaw.example.yaml:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# key_path: "~/.ssh/id_rsa"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsdocs/README_PT.md:191 · Collapsed <details> block carrying instructions<summary>💡 O que acontece por baixo dos panos</summary> 1. O OpenClaw lê `RESEARCHCLAW_AGENTS.md` → aprende o papel de orquestrador de pesquisa 2. O OpenClaw lFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
References a credential file in the home directoryconfig.researchclaw.example.yaml:132 · References a credential file in the home directory# key_path: "~/.ssh/id_rsa"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedresearchclaw/agents/figure_agent/renderer.py:327 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
References a credential file in the home directoryconfig.researchclaw.example.yaml:90 · References a credential file in the home directorykey_path: "" # Path to private key (default: ~/.ssh/id_rsa)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Auto-update or dynamic fetch configurationresearchclaw/experiment/ssh_sandbox.py:45 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef __init__(self, config: SshRemoteConfig, workdir: Path) -> None:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsdocs/README_RU.md:185 · Collapsed <details> block carrying instructions<summary>💡 Что происходит под капотом</summary> 1. OpenClaw читает `RESEARCHCLAW_AGENTS.md` → принимает на себя роль исследовательского оркестратора 2. OpenClaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsdocs/showcase/SHOWCASE.md:413 · Collapsed <details> block carrying instructions<summary>🖼️ <b>Auto-Generated Framework Diagram</b> — FAME Architecture</summary> <br> <p align="center"> <img src="thumbnails/framework_VII_fame_token_mergingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedresearchclaw/llm/acp_client.py:155 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/docker_sandbox.py:531 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/hardware.py:79 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/overleaf/sync.py:136 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/sandbox.py:418 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/hardware.py:139 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/llm/acp_client.py:385 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/agentic_sandbox.py:254 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/docker_sandbox.py:277 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/pipeline/opencode_bridge.py:365 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/sandbox.py:321 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/ssh_sandbox.py:323 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/docker_sandbox.py:201 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/code_agent.py:422 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/agentic_sandbox.py:339 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/agentic_sandbox.py:214 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/hardware.py:178 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/pipeline/opencode_bridge.py:359 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/colab_sandbox.py:72 · Python subprocess execution detectedsubprocess.run(["bash", str(setup_sh)], cwd=str(run_dir),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/cli.py:35 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/llm/acp_client.py:216 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/overleaf/sync.py:148 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/git_manager.py:114 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/llm/acp_client.py:350 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/cli.py:57 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/colab_sandbox.py:86 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/pipeline/opencode_bridge.py:477 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/ssh_sandbox.py:374 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/hardware.py:201 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionresearchclaw/experiment/metrics.py:4 · File type combined with upload action — agent may exfiltrate local data files1. ``results.json`` — structured JSON output (recommended for all domains)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/ssh_sandbox.py:136 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/agentic_sandbox.py:203 · Python subprocess execution detectedsubprocess.run(cmd, check=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/pipeline/opencode_bridge.py:353 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/agentic_sandbox.py:248 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/docker_sandbox.py:215 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/llm/acp_client.py:207 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/experiment/docker_sandbox.py:231 · Python subprocess execution detectedcp = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionresearchclaw/experiment/metrics.py:5 · File type combined with upload action — agent may exfiltrate local data files2. ``results.csv`` — tabular outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedresearchclaw/pipeline/opencode_bridge.py:292 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandresearchclaw/experiment/docker_sandbox.py:297 · Process kill command — agent can terminate processes# Force-kill the container on timeoutFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/cli.py:664 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandresearchclaw/experiment/colab_sandbox.py:11 · Process kill command — agent can terminate processes- Colab session timeouts only kill the current experiment, not the pipelineFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_rc_docker_sandbox.py:411 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = sandbox.run_project(project, entry_point="/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtests/test_rc_executor.py:1990 · Process kill command — agent can terminate processes# Subprocess stdout may not flush before kill on some platformsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionresearchclaw/prompts.py:342 · File type combined with upload action — agent may exfiltrate local data files" validated metric reporting, and results.json output. NOT using it\n"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedresearchclaw/templates/compiler.py:840 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandresearchclaw/templates/compiler.py:758 · Process kill command — agent can terminate processeswhich cause ``UnicodeDecodeError`` with ``text=True`` and kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injection attemptprompts.default.yaml:159 · Prompt injection attempt — fake system prompt · informational: not an instruction filesystem: You are a literature mining assistant.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedresearchclaw/templates/compiler.py:762 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
HTML that renders invisible but is read by the agentwebsite/getting-started.html:124 · HTML that renders invisible but is read by the agent · informational: not an instruction fileThe pipeline will execute all 23 stages autonomously. Output will be saved to the <code>output/</code> directory including the paper PDF, LaTeX source, experimeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injection attemptprompts.default.yaml:74 · Prompt injection attempt — fake system prompt · informational: not an instruction filesystem: You are a computational scientist who writes real, runnable experiments. Your code implements actual algorithmsFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_ssh_and_colab_sandbox.py:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = sandbox.run_project(project, entry_point="/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injection attemptprompts.default.yaml:108 · Prompt injection attempt — fake system prompt · informational: not an instruction filesystem: You are a publication formatting editor.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
URL to a private-network addresstests/test_web_crawler.py:234 · URL to a private-network address — a LAN or development targetresult = asyncio.run(crawler.crawl("http://10.0.0.1:9200"))Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionresearchclaw/pipeline/verified_registry.py:267 · File type combined with upload action — agent may exfiltrate local data files2. ``experiment_summary_best.json`` at run root (repair cycle output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandtests/test_servers.py:202 · Process kill command — agent can terminate processesproc.kill = AsyncMock()Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injection attemptprompts.default.yaml:173 · Prompt injection attempt — fake system prompt · informational: not an instruction filesystem: You are a strict domain-aware reviewer. Reject off-topic papers aggressively.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actiontests/test_rc_citation_verify.py:605 · File type combined with upload action — agent may exfiltrate local data filesassert "verification_report.json" in contract.output_filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
OS command execution function call detectedtests/test_rc_validator.py:177 · OS command execution function call detectedassert result.issues[0].message == "Dangerous call: os.system()"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
URL to a private-network addresstests/test_web_crawler.py:189 · URL to a private-network address — a LAN or development targeterr = check_url_ssrf("http://10.0.0.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Prompt injection attemptprompts.default.yaml:95 · Prompt injection attempt — fake system prompt · informational: not an instruction filesystem: You are a principal investigator designing ML experiments.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_web_crawler.py:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr = check_url_ssrf("file:///etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_web_crawler.py:197 · URL to a private-network address — a LAN or development targeterr = check_url_ssrf("http://192.168.1.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_rc_sentinel.py:107 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_entry_point_validation.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr = validate_entry_point("src/../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_entry_point_validation.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr = validate_entry_point("../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_ssh_and_colab_sandbox.py:186 · Auto-update or dynamic fetch configuration — agent may load new code at runtimecfg = SshRemoteConfig(host="nonexistent-host-12345.invalid")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL to the cloud instance metadata addresstests/test_web_crawler.py:201 · URL to the cloud instance metadata address — reads the VM's credentialserr = check_url_ssrf("http://169.254.169.254/latest/meta-data")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstests/test_entry_point_validation.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserr = validate_entry_point("/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Unpinned dependencyconfig.researchclaw.example.yaml:102 · Unpinned dependency# Install: npm i -g opencode-ai@latest (or use `researchclaw setup`)Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Python subprocess execution detectedtests/test_rc_sentinel.py:125 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_web_crawler.py:226 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = crawler.crawl_sync("file:///etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_ssh_and_colab_sandbox.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescfg = SshRemoteConfig(host="server", key_path="~/.ssh/my_key")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/templates/compiler.py:580 · Python subprocess execution detected``subprocess.run(text=True)`` and prevents the bibtex + multi-passFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Unpinned dependencyresearchclaw/config.py:321 · Unpinned dependencyRequires: npm i -g opencode-ai@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_codegen_v2.py:467 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_entry_point_validation.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = sandbox.run_project(project, entry_point="/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_web_crawler.py:193 · URL to a private-network address — a LAN or development targeterr = check_url_ssrf("http://172.16.0.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionresearchclaw/pipeline/stage_impls/_literature.py:330 · File type combined with upload action — agent may exfiltrate local data files# Read queries.json from Stage 3 (F1.5 output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsentinel.sh:94 · Process kill command — agent can terminate processeskill -0 "$pid" 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedresearchclaw/wizard/validator.py:53 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionresearchclaw/pipeline/verified_registry.py:310 · File type combined with upload action — agent may exfiltrate local data files# --- 2. experiment_summary_best.json (repair cycle output) ---Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Unpinned dependencyresearchclaw/cli.py:107 · Unpinned dependencyprint(" 2. Run: npm i -g opencode-ai@latest")Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_ssh_and_colab_sandbox.py:376 · Auto-update or dynamic fetch configuration — agent may load new code at runtimessh_remote=SshRemoteConfig(host="nonexistent.invalid"),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈3,486 tok
13 files · 404 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

41 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim donwrightdesigns: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  5. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim donwrightdesignsPropose a patch to the maintainer