Academic Deep Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 2.0.0

Overview

The skill is a mostly transparent research workflow, but it automatically consults persistent agent memory without clear user consent or scope limits.

Install only if you are comfortable with the agent searching prior persistent memory as part of research. Before using it, ask the agent not to use memory unless you explicitly approve the specific records or topic scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:430

Finding

Unnecessary Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30 and 430–443
Vulnerability Type: Excessive access to persistent cross-session memory
Risk Level: Medium

Complete Code Snippet:

markdown

| `memory_search` / `memory_get` | Cross-reference prior knowledge | Check MEMORY.md for related context |

markdown

### Memory Search Integration

Before starting research, check for relevant prior knowledge:

?memory_search(query="previous research on [topic]") ?memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]

text

Use prior findings to:
- Avoid duplicate research
- Build on previous conclusions
- Identify how understanding has evolved
- Note persistent gaps from prior research

Technical Analysis

The Skill instructs the agent to search persistent memory and retrieve dated memory files before beginning research. Persistent memory may contain information from prior conversations, users, or unrelated tasks. The instructions do not restrict retrieval to records belonging to the current user or task, require sensitivity filtering, or obtain informed user consent before access.

This access is not essential to the Skill's primary function of conducting web-based academic research. It therefore exceeds the minimum privileges necessary for the declared functionality. Although the Skill does not explicitly instruct the agent to transmit memory contents externally, retrieved information could influence web-search queries, be copied into tasks sent to spawned sub-agents, or appear in intermediate analysis and final reports.

The audited file does not contain credential theft, executable payloads, dependency installation, persistence mechanisms, or an explicit command to upload sensitive data. Its web_search and web_fetch use is otherwise aligned with the declared research purpose.

Attack Path

1. Persistent agent memory contains private or sensitive information ...[truncated 1354 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional instruction to inspect persistent memory before every research task.
2. Make memory access opt-in and obtain explicit, informed user approval describing what records will be searched and why.
3. Restrict searches to records associated with the current user, workspace, and approved research topic.
4. Retrieve only the minimum required fields rather than entire dated memory files.
5. Apply sensitivity classification and redact personal data, credentials, confidential business information, and unrelated conversation content.
6. Prohibit memory-derived sensitive information from being included in web queries, fetched URLs, sub-agent task descriptions, intermediate output, or final reports.
7. Add authorization checks, tenant isolation, access logging, and auditable provenance for each memory retrieval.
8. When memory access is unavailable or not authorized, continue with web research rather than treating persistent memory as a prerequisite.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger guidance includes the phrase "Tell me everything about X," which is broad enough to match many ordinary user requests that are not actually asking for this specialized skill. Overbroad activation criteria can cause unintended invocation, leading the agent to enter a high-cost, tool-using research workflow without clear user intent, increasing the risk of unnecessary external data access and confusing behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.