Security audit

Deep Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent deep-research workflow that uses web research and saves reports, with some non-malicious cautions around broad activation and optional CDN-based HTML output.

Install only if you want a structured research-report workflow that can perform multiple web searches and save files under ./reports. Review the outline before approving research, and be cautious with optional HTML reports because they load JavaScript from CDNs when opened in a browser.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/html-guide.md:23
Finding: Unpinned Third-Party JavaScript Dependencies Without Integrity Verification
Content: View full analysis
``` ### Technical Analysis The HTML-generation guidance instructs the agent to load executable JavaScript from third-party content delivery networks using URLs that do not specify immutable package versions. It also does not require Subresource Integrity (SRI) hashes. Paths such as `mermaid/dist/mermaid.min.js` and `echarts/dist/echarts.min.js` may resolve to different package releases over time. Consequently, the code executed by a generated report can change after the Skill has been reviewed. The Tailwind browser script is similarly loaded without integrity verification. This creates a supply-chain trust boundary in which the security of every generated HTML report depends on the CDN, its delivery infrastructure, package publisher accounts, and mutable upstream artifacts. If any of these are compromised, malicious JavaScript can be delivered when a user opens a report. ### Attack Path 1. A user invokes the Skill and requests optional HTML rendering. 2. The Skill generates an HTML report containing the documented CDN script references. 3. The generated report is opened in a browser while network access is available. 4. The browser retrieves executable JavaScript from the external CDN. 5. An attacker who has compromised an upstream package, publisher account, CDN distribution path, or mutable artifact causes malicious JavaScript to be returned. 6. The browser executes that JavaScript in the report's page context because neither an immutable ver ...[truncated 1266 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation description is broad and ambiguous, describing substantive research, sourced long-form answers, and investigation without clear boundaries. In an agent setting, ambiguous invocation criteria can route many borderline requests into a high-privilege workflow that performs web searches, fetches external content, and writes output files, increasing the attack surface and likelihood of unintended tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday phrases such as '帮我了解' and '全面梳理', which can match many ordinary requests unrelated to deep research. Over-broad activation can cause the skill to engage unexpectedly, leading to unnecessary web access, excessive data collection, long multi-step execution, and unintended file creation for requests that did not warrant this workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, which can amount to a language/locale policy violation when no opt-in or alternative language option is provided. The file does not indicate that the skill is region-specific or intentionally limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains natural-language instructions entirely in Chinese and frames them as the required writing standard (for example, the title and all directive language). Under the policy, forcing a specific language without user opt-in is a locale/language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Stage 4 explicitly instructs '不写文件' and says each task conclusion should be shown directly in chat, which communicates a no-file-write execution model for the research process. However, Stage 6 later requires persisting the final report to reports/...md, so the documentation presents contradictory intent about whether the workflow performs file writes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.