Topic Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill performs its stated research workflow, but it asks users to run an unverified remote installer and can send arbitrary local file excerpts to Tavily without adequate scoping or warning.

Review before installing. Use a safer Tavily CLI installation method if available, and do not run this skill on untrusted request files. Avoid `source_file` values pointing to secrets, private notes, internal documents, env files, or paths outside the intended inbox, because excerpts may be sent to Tavily and retained in raw JSON output.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:26

Finding

Unverified Remote Installation Script Executed Directly by Bash

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: runtime.py:84

Finding

Unrestricted Source File Read Can Disclose Local Data to Tavily

Content

View full analysis

Path: candidate = Path(path_value) return candidate if candidate.is_absolute() else workspace_root / candidate ``` The resulting path is read based only on an existence check: ```python source_file = clean_text(frontmatter.get("source_file")) resolved_source: Path | None = None source_excerpt = "" if source_file: resolved_source = resolve_source_file(source_file, workspace_root) if not resolved_source.exists(): raise FileNotFoundError(f"source_file not found: {resolved_source}") source_excerpt = truncate_text(read_text(resolved_source), 1200) ``` The excerpt is incorporated into the externally submitted research query: ```python if request["source_excerpt"]: parts.append("首轮扫描上下文：\n" + request["source_excerpt"]) ``` The query is then passed to the Tavily CLI: ```python command = ["tvly", "research", query, "--json", "--model", request["model"]] completed = subprocess.run( command, cwd=vendor_root, capture_output=True, text=True, encoding="utf-8", ) ``` The full command, including the query and source excerpt, is also persisted in the raw output file: ```python json.dumps( { "generated_at": datetime.now().isoformat(timespec="seconds"), "request": { "topic": request["topic"], "question": request["question"], "model": request["model"], "source_file": str(request["source_file"]) if request["source_file"] is not None else "", "seed_urls": request["seed_urls"], "request_path": str(input_path), }, ...[truncated 2610 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The README instructs users to execute a remote script directly with curl ... | bash, which grants immediate shell execution to code fetched over the network without prior inspection or integrity verification. If the remote host, transport path, or published install script is compromised, this can lead to arbitrary code execution on the user's machine during setup.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

按 repo 内置 skill 的说明先安装并登录 tvly：

bash

curl -fsSL https://cli.tavily.com/install.sh | bash && tvly login

安装完成后，确保下面命令能正常返回：

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file presents the skill description and usage instructions entirely in Chinese, which can amount to a language-policy issue when no user opt-in or justified locale limitation is provided. The policy specifically calls for flagging cases where a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads inputs, and writes output files, but the manifest declares no explicit tool scope or permissions boundary. That makes the skill over-privileged by default and increases the chance an agent runtime will allow broader file-system or shell access than users expect, especially when processing attacker-controlled markdown input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example question and supplemental instruction explicitly steer output toward Chinese-language公众号 topic selection without documenting that this is optional or user-selected. This creates a natural-language locale preference baked into the skill description rather than offering a language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to combine user-provided topic text, questions, source references, and seed URLs into a query sent to the external Tavily CLI, but it does not warn that this data leaves the local environment. Users may unknowingly transmit sensitive research topics, internal URLs, or proprietary context to a third-party service, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

If source_file is provided, up to 1200 characters of that local file are read and embedded into the research query sent to the external Tavily CLI. That creates a real data-exfiltration/privacy risk because potentially sensitive local content is transmitted off-host without any consent, classification check, or warning in this code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The query explicitly instructs output for a Chinese content team, and the rest of the file generates Chinese-language report content and audience assumptions. This imposes a specific language/locale behavior without any visible user opt-in or configurable language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends topic, question, notes, seed URLs, and possibly source excerpts to an external research service via the tvly CLI. In this skill context, that is a meaningful confidentiality issue because users may assume local processing while the code silently transmits potentially sensitive prompts and context to a third-party service.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · runtime.py (reported line 332)May include surrounding context.

python

query = build_query(request)

    command = ["tvly", "research", query, "--json", "--model", request["model"]]
    completed = subprocess.run(
        command,
        cwd=vendor_root,
        capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reader_hint is hard-coded as a Chinese long-form public-account readership, which bakes a specific language/locale assumption into downstream content decisions. No alternative locale or user-controlled setting is provided in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code persists the full request metadata, stderr, vendor path, command arguments, and returned payload to local JSON files under content-production/inbox/raw/research. This can create secondary exposure of sensitive research topics, local file paths, source excerpts embedded in payloads, and service error details, especially in shared workspaces or repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown explicitly states that the skill outputs a research report and saves raw JSON locally, which affects user data storage and workspace contents. Under the markdown-file criteria for missing warnings, there is no user-facing caution here about overwriting, storing potentially sensitive research content, or retaining source data.

Content

No source excerpt is available for this finding.