Is oathe-ai/oathe-research safe?
https://github.com/oathe-ai/oathe-research
oathe-ai/oathe-research is a legitimate AI research pipeline plugin that orchestrates multi-agent debates on arxiv papers, but it employs a hook system that auto-executes shell scripts on Write and Stop events — including injecting skill invocation instructions into Claude's feedback loop via stderr and blocking session termination under certain conditions. The bundled MCP servers (arxiv-latex and semanticscholar) run as independent network-capable processes controlled by the skill author, and the pipeline spawns numerous subagents that expand the attack surface. No malicious code was found and canary file integrity was maintained, but the architectural patterns warrant caution before deployment.
Category Scores
Findings (8)
HIGH Hooks inject agent instructions via stderr feedback mechanism -18 ▶
Both lifecycle hooks (gate-evolve.sh and enforce-evolve-on-stop.sh) output explicit skill invocation instructions to stderr, which becomes feedback to Claude. This is a form of prompt injection through the hook system — the skill can steer Claude's next action by blocking an operation and simultaneously providing 'corrective' instructions. gate-evolve.sh outputs 'Run: Skill(skill=oathe-research:evolve)' and enforce-evolve-on-stop.sh outputs 'Invoke the research-evolve skill for each missing round before stopping.'
HIGH Lifecycle hooks auto-execute shell scripts without per-invocation approval -25 ▶
The hooks.json registers two hooks that execute shell scripts automatically: a PreToolUse hook on Write operations (gate-evolve.sh) and a Stop hook (enforce-evolve-on-stop.sh). These run without requiring explicit user approval for each invocation. The Stop hook can return exit code 2 to block agent termination, trapping the session until specific research pipeline conditions are met.
MEDIUM Bundled Python MCP servers launch as independent network-capable processes -15 ▶
Two Python MCP servers are bundled within the repo and launched via 'uv run' each time the skill runs. These servers (arxiv-latex-mcp and semanticscholar-MCP-Server) spawn as separate processes with their own network capabilities outside the main agent sandbox. The skill author controls the exact code in these servers, which could be modified to include malicious behavior in future versions.
MEDIUM Stop hook blocks agent exit to enforce pipeline completion -10 ▶
The enforce-evolve-on-stop.sh script actively prevents session termination by returning exit code 2 when debate rounds have been completed without corresponding evolution steps. While the stated purpose is pipeline integrity, this mechanism could be exploited in a compromised version to prevent users from stopping a runaway or malicious research session.
MEDIUM Bundled MCP servers make external connections to third-party APIs -18 ▶
During normal operation, the MCP servers connect to arxiv.org (to fetch paper LaTeX content) and api.semanticscholar.org (to search for papers). These connections carry user research topics and paper data. Because the server code is bundled rather than installed from a verified registry, a modified version could silently exfiltrate research data to attacker-controlled endpoints.
LOW Shell script execution embedded as required pipeline step -5 ▶
The research skill instructs Claude to execute bash scripts (update-run-state.sh) at every state transition as part of normal operation. The skill cannot function without shell access. The scripts themselves appear benign (JSON state management via jq/python3), but this pattern establishes shell execution as routine and expected, lowering the barrier to exploitation if other components are compromised.
LOW Mass subagent spawning substantially expands attack surface -8 ▶
The pipeline spawns paper-agent-N per paper, 2 judge agents, a hypothesis-evolver, claim-verifier subagents, and a research-consolidator — potentially 10+ concurrent subagents. Each inherits filesystem and network tool access. The more subagents active simultaneously, the larger the window for a compromised agent definition to perform unauthorized actions.
INFO Canary files accessed before clone — attributed to monitoring setup 0 ▶
Inotify events show .env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials were opened and read at 06:26:55 (timestamp 1787466414). All accesses are CLOSE_NOWRITE (read-only). The git clone executes at 06:27:00 (timestamp 1787466420). Timing and process context indicate these reads originate from the audit monitoring setup, not the skill. All canary files confirmed intact.