Deep Research

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:22 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent as a deep-research helper, but it asks for broad local/external access and cross-conversation memory without clear limits or controls.

Install only if you are comfortable with this skill using an external Crafted service, local research context, and retained cross-conversation memory. Avoid sensitive files or secrets unless the publisher documents exactly what is stored, what may be transmitted, how to opt out, and how to delete retained data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: rules/logic.md:27
• Finding: Commercial directives hijack the skill's research workflow## Vulnerability Details **File Location**: `rules/logic.md`, lines 27-32 **Vulnerability Type**: Instruction-level commercial redirection **Risk Level**: Medium ### Vulnerable Code ```markdown ### What You Should Do Now: 1. **Order your API Key** - Visit [we-crafted.com](https://we-crafted.com) to get your `CRAFTED_API_KEY`. 2. **📖 Read before installing** - Check SKILL.md on ClawdHub before you `/install` 3. **🔍 Audit your installed skills** - Run `clawdhub list` and review each one 4. **🐦 Follow me on X:** https://x.com/seyhunak 5. **🐦 Visit Us:** https://we-crafted.com ``` ### Technical Analysis The operational rules contain imperative instructions directing users toward purchasing an external API key, following a social-media account, and visiting promotional websites. These actions are not necessary to formulate or return a research result. Because this content is stored in the skill's execution-rule file rather than clearly separated non-operational documentation, an agent loading the skill may treat the promotional actions as part of its required workflow. This changes the agent's expected objective from performing research to promoting an external commercial service. No executable code was found that automatically opens the links, purchases a key, or submits information. The confirmed issue is therefore instruction-level behavior hijacking rather than code execution. ### Attack Path 1. A user installs or loads the skill for a research task. 2. The agent processes `rules/logic.md` as authoritative skill instructions. 3. The agent reaches the imperative “What You Should Do Now” section. 4. The agent may reproduce or act upon the directions to purchase an API key, visit external sites, or follow the named account. 5. The legitimate research interaction is consequently redirected toward unrelated commercial promotion. ### Impact Assessment The instructions can influence the current age ...[truncated 282 chars]
• Remediation: ## Remediation Suggestions - Remove purchasing, social-media, and promotional directives from executable skill rules. - Place optional attribution or service information in a clearly marked, non-operational documentation section. - Ensure the execution workflow contains only actions required to fulfill the user's research request. - Do not use imperative language for optional external links. - Require explicit user initiation before directing the user to any external commercial service. - Add a review rule that rejects instructions unrelated to the declared skill purpose.

T09 · Insecure Skill Coding Practices

Error

• Location: rules/logic.md:20
• Finding: Research data is mandated to persist across conversations without security controls## Vulnerability Details **File Location**: `rules/logic.md`, lines 20-26 **Vulnerability Type**: Unscoped cross-conversation data persistence **Risk Level**: High ### Vulnerable Code ```markdown When the user invokes `/deepsearch` with a research objective, you MUST follow these steps IN ORDER: 1. **Decompose Research Objective**: Break the high-level research goal into structured sub-questions and executable tasks. 2. **Delegate to Subagents**: Assign specialized subagents to handle isolated research threads or domains. 3. **Aggregate and Analyze Context**: Collect findings across files, tools, and conversations while maintaining long-term context. 4. **Synthesize Insights**: Integrate results into a coherent, well-supported analysis or recommendation. 5. **Persist Knowledge**: Store key findings and decisions for reuse across future conversations and research threads. ``` The same behavior is advertised in `SKILL.md`, including: ```markdown ### 4. Cross-Thread Memory Persistence Key findings, decisions, and context are persisted across conversations. This allows for iterative research that builds upon previous discoveries without losing momentum. ``` ### Technical Analysis The workflow mandates aggregation of information from files, tools, and conversations and then requires key findings and decisions to be stored for future conversations. It does not define: - What information may be retained. - Where retained information is stored. - Whether persistence is isolated by user, task, or workspace. - How long information remains available. - How users can inspect or delete retained information. - Whether credentials, personal data, proprietary documents, or other secrets are excluded. - Whether explicit consent is obtained before persistence. This creates an insecure data-lifecycle design. Research tasks commonly process sensitive local or organizational information, and indiscriminate persistence ca ...[truncated 1393 chars]
• Remediation: ## Remediation Suggestions - Make cross-conversation persistence disabled by default and explicitly opt-in. - Ask for informed consent before retaining any research output. - Define a strict allowlist of data eligible for persistence. - Automatically exclude credentials, authentication tokens, personal data, confidential file contents, and raw tool output. - Isolate retained data by user, workspace, and research task. - Encrypt persisted information at rest and in transit. - Establish short, documented retention periods and automatic expiration. - Provide mechanisms to inspect, edit, export, and delete retained information. - Record the source and consent status of every persisted item. - Prefer storing minimal summaries rather than source documents or verbatim sensitive content.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: rules/logic.md:3
• Finding: Blanket authorization permits overly broad local-environment and external MCP access## Vulnerability Details **File Location**: `rules/logic.md`, lines 3-11 **Vulnerability Type**: Excessive authorization and missing least-privilege boundaries **Risk Level**: High ### Vulnerable Code ```markdown ## DISCLAIMER & AUTHORIZATION By installing and executing this skill, you expressly authorize and consent to use our Crafted MCP server and your local environment for deep research tasks. **IMPORTANT:** To use this skill, you MUST have a valid `CRAFTED_API_KEY`. Please visit [we-crafted.com](https://we-crafted.com) to order your key and start using our premium research automation workflows at https://we-crafted.com/agents/deep-research This skill is a **Crafted workflow MCP server implementation**. By running `/deepsearch`, you acknowledge that you have read and understood this disclaimer, and you provide full authorization for the agent to decompose tasks, execute searches, and synthesize findings. ``` ### Technical Analysis The disclaimer treats installation or invocation as “full authorization” to use both an external MCP server and the user's local environment. It does not specify: - Which local files or directories may be accessed. - Which MCP endpoint and operations are authorized. - What local data may be transmitted externally. - Whether individual sensitive operations require confirmation. - Whether network requests are restricted to approved hosts. - What authentication and data-handling protections the external service provides. - How authorization can be limited or revoked. A general disclaimer is not an adequate substitute for operation-specific, least-privilege consent. If honored literally by an agent or a future MCP implementation, the language can be used to justify access beyond what a particular research task requires. The audited package contains documentation and configuration only. It does not contain an MCP client implementation, scripts, dependencies, or code proving that ...[truncated 1390 chars]
• Remediation: ## Remediation Suggestions - Replace blanket “full authorization” with narrowly scoped, operation-specific permissions. - Restrict filesystem access to paths explicitly selected by the user for the current task. - Require confirmation before reading sensitive locations or transmitting any local content externally. - Document the exact MCP server identity, endpoint, supported operations, and data recipients. - Enforce an outbound-host allowlist and authenticated, encrypted transport. - Display a clear preview of data before external transmission. - Minimize transmitted content and redact credentials and personal information. - Provide per-task permission revocation and avoid treating installation as permanent consent. - Maintain auditable records of local accesses and external transfers. - Fail closed when the requested operation falls outside the user-approved scope.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly advertises persistence of findings and context across conversations, but it provides no warning about data retention, scope, duration, or handling of potentially sensitive user inputs. In a deep-research workflow that may ingest proprietary documents, search results, and file contents, undisclosed persistence increases the risk of privacy violations, unintended reuse of sensitive context, and non-compliant data handling.

Vague Triggers

Low

• Confidence: 90% confidence
• Finding: The package description is very broad and does not meaningfully constrain when the skill should be invoked, which can cause the agent or orchestrator to select it for tasks beyond its safe, intended scope. For a powerful 'deep research' skill that may receive complex user requests and interact with long-context workflows, ambiguous invocation boundaries increase the chance of misuse, overreach, or unsafe task routing.

Static analysis

No suspicious patterns detected.