# Security Audit Report — Deep Research Pipeline
**Date: 2026-03-24 | Auditor: Claude Opus 4.6 (automated)**

## Threat Context

In February 2026, multiple security firms disclosed massive supply-chain attacks on ClawHub:
- **ClawHavoc campaign**: 824+ malicious skills across 12 publisher accounts (hightower6eu, zaycv, Aslaep123, pepe276, moonshine-100rze, Ddoy233, hedefbari, aztr0nutzs, others)
- **Snyk ToxicSkills audit**: 534 skills (13.4%) with critical issues; 76 confirmed malicious payloads
- **Primary attack vector**: Fake "prerequisite installation" instructions in SKILL.md with base64-encoded commands installing Atomic Stealer (AMOS) on macOS

None of our target skills/authors appear on known malicious publisher lists.

---

## ClawHub Skills

### SAFE — Install with confidence

| Skill | Stars | Author | Notes |
|-------|-------|--------|-------|
| **agent-deep-research** | ~1 (new) | Basit Mustafa (CTO, Procurement Sciences) | Clean code, all calls to Google Gemini only, explicit anti-exfiltration measures |
| **last30days** | 5,100 | Matt Van Horn (Lyft co-founder) | Most mature skill audited, 455+ tests, extensive validation |
| **arxiv-watcher** | Low | rubenfb23 | Minimal — queries public arXiv API, stores locally, no credentials needed |
| **x-research-skill** | 994 | Rohun Vora | Clean TypeScript, only calls api.x.com, rate-limited, MIT license |
| **wikipedia-oc** | Low | rachmann-alexander | Read-only Wikipedia API wrapper, zero attack surface |

### CAUTION — Install with precautions

| Skill | Stars | Risk | Mitigation |
|-------|-------|------|------------|
| **openclaw-search-skills** | 361 | Env var base URL override could redirect credentials; plaintext credential storage; SSRF via link-following | Lock down API base URLs in config, don't use credential file storage |
| **pubmed-edirect** | Low | Downloads and executes external install scripts from NCBI FTP | Review scripts before running; skill author explicitly warns about this |
| **openclaw-free-web-search** | 5 | TLS relaxation when local proxy detected; aggressive anti-bot fingerprinting | Low star count, run in isolation, review install scripts |

### REJECT — Do not install

| Skill | Reason |
|-------|--------|
| **literature-manager** | Does not exist on ClawHub or GitHub. Could be typosquat target. |
| **super-research** | Cannot locate source, author, or code. Matches social engineering patterns from ClawHavoc. |

---

## MCP Servers

### SAFE — Deploy immediately

| Server | Stars | Author | Version | Notes |
|--------|-------|--------|---------|-------|
| **knowledge-graph-memory** | 81,900 (mono) | Anthropic (official) | 0.6.3 / 2026.1.26 | Minimal deps (MCP SDK only), local JSON storage, no external services |
| **fetch MCP** | 81,900 (mono) | Anthropic (official) | 0.6.3 / 2025.4.7 | Clean deps, respects robots.txt. **Note**: SSRF risk to internal IPs by design — deploy with network controls |
| **firecrawl-mcp** | 5,800 | Mendable/Firecrawl (YC-backed, $17.7M raised) | 3.10.3 | Clean TypeScript, Zod validation, enterprise-grade. Data routes through Firecrawl cloud. |

### CAUTION — Use with modifications

| Server | Stars | Risk | Mitigation |
|--------|-------|------|------------|
| **paper-search-mcp** | 879 | Anonymous author (openags org, no public members); unpinned deps; SOCKS proxy support; optional Sci-Hub | Fork, pin all deps, audit SOCKS/Sci-Hub code paths. Functional coverage of 20+ databases is excellent. |

### REJECT — Do not deploy

| Server | Reason |
|--------|--------|
| **crawl4ai-rag** | Pins crawl4ai 0.6.2 which has **CVE-2026-26216 (CVSS 9.8 — unauthenticated RCE)**. Fix requires >= 0.8.0. Repo unmaintained since June 2025. Also requires OpenAI + Supabase data flow. |
| **semantic-scholar-mcp** | 58 stars, 3 total commits, abandoned since March 2025, all deps unpinned. Functionality already covered by paper-search-mcp. |

---

## Final Approved Stack

### Skills to Install
1. agent-deep-research
2. last30days
3. arxiv-watcher
4. x-research-skill
5. wikipedia-oc
6. openclaw-search-skills (with env var lockdown)
7. pubmed-edirect (review install scripts first)

### MCP Servers to Deploy
1. knowledge-graph-memory (Anthropic official)
2. fetch MCP (Anthropic official, with network controls)
3. firecrawl-mcp (Firecrawl/Mendable)
4. paper-search-mcp (fork and pin deps)

### Deferred
- crawl4ai-rag — revisit if/when crawl4ai dep is updated past 0.8.0
- openclaw-free-web-search — revisit if Brave/Tavily free tiers are insufficient

---

## Phase 2 Audit (2026-03-24)

### MCP Servers

#### SAFE — Deploy immediately

| Server | Stars | Author | Notes |
|--------|-------|--------|-------|
| **bcc-research** (remote MCP) | N/A (official) | BCC Research (est. 1971, Boston) | Public MCP server at `public.mcp.bccresearch.com/mcp`. No auth required. One tool: `semantic_search` over market research reports. Announced via GlobeNewsWire press release (Nov 2025). Domain verified via SSL cert. Returns only catalog metadata — no full-text exposure. AI-friendly robots.txt (ClaudeBot explicitly allowed). |
| **ieee-xplore** | 0 (new) | Daniel Tyukov (danieltyukov, 6yr GitHub account, 101 repos, 62 followers) | ~400 lines TypeScript. 6 read-only tools wrapping IEEE Xplore REST API. No eval/exec/fs/child_process. API key redacted in logs. Only outbound calls to `ieeexploreapi.ieee.org`. 2 deps (MCP SDK + Zod). npm audit: 3 high vulns in transitive deps (hono, express-rate-limit) — all fixed via `npm audit fix`. Author has contextually relevant IEEE SSCS contributions. |

### Databases Assessed (Not Requiring MCP Servers)

| Database | Assessment |
|----------|-----------|
| **ACM Digital Library** | No API. ACM went full open access Jan 2026 but blocks bots (Cloudflare 403). All 743K+ ACM papers already indexed in Crossref, Semantic Scholar, OpenAlex, and DBLP. No action needed. |
| **Google Scholar** | No official API. SerpAPI ($75/mo) is the only reliable programmatic option. 95%+ of papers already in Semantic Scholar + OpenAlex. Pitt `inst=` link only affects browser display. Deferred. |
| **Google Research Pubs** | No API. All papers have DOIs and are indexed in arXiv/Semantic Scholar/OpenAlex. No action needed. |
| **Web of Science** | Free Starter API (50 req/day trial, 5K/day institutional). Unique value: official Impact Factors. Deferred — OpenAlex covers discovery use cases. |
| **EBSCO Business Source Complete** | EDS API exists with Python client `ebscopy`. Requires institutional credentials from Pitt library. Unique content: 31K company profiles, 9K industry reports, 5K SWOT analyses, HBR full-text. Deferred — requires Pitt library coordination. |

---

## Pin refresh note (2026-10-29)

`ieee-mcp` is pinned in `config/skills.lock.json` to upstream commit `9ced907` (2026-10-24). The audit above covered the March 2026 snapshot of that repository; the newer commit was not re-audited line by line. Review the diff before trusting it in a sensitive environment: `git log --oneline` in a fresh clone of `danieltyukov/ieee-mcp`.

`firecrawl-mcp` stays pinned at the audited 3.10.3. Override with `FIRECRAWL_MCP_VERSION` if you want a newer release.