Academic Deep Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 2.0.0

Overview

This is a research skill with coherent goals, but it asks to use persistent memory by default without clear user consent or scoping.

Review this skill before installing if you use persistent agent memory. It is not showing destructive behavior or exfiltration, but you should only use it where searching prior memory is acceptable, or require explicit approval before memory_search or memory_get are used.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:430

Finding

Unnecessary Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 430–443
Vulnerability Type: Excessive access to persistent cross-session memory
Risk Level: Medium

markdown

### Memory Search Integration

Before starting research, check for relevant prior knowledge:

?memory_search(query="previous research on [topic]") ?memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]

text

Use prior findings to:
- Avoid duplicate research
- Build on previous conclusions
- Identify how understanding has evolved
- Note persistent gaps from prior research

Technical Analysis

The Skill instructs the Agent to search and retrieve persistent memory before conducting research. Access to cross-session memory is not inherently required for the declared web-research functionality, which can operate using the current request, user-approved research plan, web_search, and web_fetch.

A topic-based memory query does not provide a reliable authorization boundary. Matching records could contain private user information, sensitive historical conversations, credentials, internal operational details, or material belonging to an unrelated task. The instructions do not require explicit user consent before accessing these records, restrict retrieval to records selected by the user, or prohibit memory-derived information from being included in sub-agent prompts, search queries, or final reports.

The audited file does not explicitly instruct the Agent to transmit memory contents to an external endpoint. Consequently, direct data exfiltration is not established. The vulnerability is instead a least-privilege violation that unnecessarily exposes persistent information to the active research context.

Attack Path

1. Persistent Agent memory contains sensitive information from an earlier session.
2. A new research request uses a topic or terminology that overlaps with that stored information.
3. Following the Skill instructions, the Agent invokes `memory_search ...[truncated 1299 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory memory access from the default research workflow. Web research should proceed without persistent memory unless the user explicitly requests historical context.
2. Before any memory search, explain why access is useful, what categories of records may be searched, and how retrieved information may be used.
3. Require explicit, task-specific user approval before invoking memory_search or memory_get.
4. Restrict searches to a narrow user-approved topic, date range, project identifier, or list of records rather than searching general persistent memory.
5. Present matching record metadata first and require the user to select a record before retrieving its contents.
6. Retrieve only the minimum excerpts needed for the approved purpose and redact credentials, personal data, secrets, and unrelated context.
7. Add an explicit prohibition against placing memory-derived sensitive information into web-search queries, fetched URLs, sub-agent task descriptions, or reports without separate consent.
8. Preserve provenance labels for memory-derived claims so they are not mistaken for independently verified evidence.
9. If the platform supports access controls, isolate memory by user, project, and task and deny cross-scope retrieval by default.
10. Record memory-access consent and the specific records retrieved in an auditable log.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad and map to common, ambiguous user requests such as 'tell me everything about X' or any request involving verification or multi-source investigation. This can cause the skill to activate outside narrowly intended contexts, leading to unnecessary web access, excessive tool use, and unexpected delegation of user queries into a high-autonomy research workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.