Research Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This skill claims to perform web research with citations, but its implementation generates placeholder sources and citations instead of actually searching or verifying information.

Review this skill carefully before installing. It does not appear to steal data or run dangerous system actions, but its reports and citations should not be trusted as real research unless the implementation is changed to use actual source retrieval, verification, and safer prompt/data separation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:52

Finding

Prompt Injection Through Untrusted Research Inputs

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 52–113
Vulnerability Type: Untrusted input embedded directly into LLM instructions
Risk Level: Medium

Vulnerable Code

javascript

async createPlan(topic, depth) {
  const prompt = `Create a research plan for: ${topic}

Depth: ${depth}

Include:
1. Key research questions
2. Search terms and queries
3. Types of sources to look for
4. Analysis framework

Return structured plan.`;

  return await this.llm.generate(prompt);
}

async analyze(topic, sources) {
  const prompt = `Analyze these sources about: ${topic}

Sources:
${sources.map(s => `- ${s.title}: ${s.summary}`).join('\n')}

Provide:
1. Key findings
2. Consensus points
3. Conflicting information
4. Trends and patterns
5. Gaps in research`;

  return await this.llm.generate(prompt);
}

async generateReport(topic, analysis, sources) {
  const prompt = `Generate a comprehensive research report:

Topic: ${topic}

Analysis:
${analysis}

Sources:
${sources.map(s => `${s.title} - ${s.url}`).join('\n')}

Structure:
1. Executive Summary
2. Key Findings
3. Detailed Analysis
4. Methodology
5. Citations
6. Recommendations`;

  const content = await this.llm.generate(prompt);

Technical Analysis

The topic value originates from the caller of research() and is inserted directly into prompts passed to this.llm.generate(). It is not validated, length-limited, structurally separated from instructions, or explicitly marked as untrusted data.

An attacker can therefore supply a topic containing instruction-like text that tells the model to ignore the surrounding research instructions, alter the requested output, fabricate findings, or suppress citations. The value reaches both createPlan() and analyze().

The resulting analysis is subsequently inserted into the report-generation prompt in the same unstructured manner. This creates a sec ...[truncated 2091 chars]

Remediation

View remediation

Remediation Suggestions

1. Use an LLM API that supports separately typed system, developer, user, and data messages. Keep application instructions in a higher-trust message and place topic, source content, and prior model output in clearly identified untrusted-data messages.
2. Enclose untrusted values in explicit delimiters and instruct the model that content inside those delimiters is data only and that any instructions contained within it must not be followed.
3. Apply schema validation to research requests. Require topic and depth to be strings from expected formats, enforce conservative length limits, and reject control sequences or unsupported values.
4. Request structured output using a strict JSON schema and validate every response before passing it to the next stage.
5. Do not feed unrestricted model output back into another instruction prompt. Parse the analysis into validated fields and pass only those fields to report generation.
6. Treat source titles, summaries, URLs, and fetched web content as untrusted because indirect prompt injection can also originate from external documents.
7. Apply least privilege to any tool-enabled LLM integration. Require explicit authorization for consequential operations and never permit model-generated text alone to trigger shell commands, file access, credential use, or external side effects.
8. Add adversarial tests covering direct and second-order prompt injection, including attempts to override instructions, suppress citations, fabricate sources, and escape data delimiters.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill metadata and documentation claim concrete capabilities—web research, source verification, citations, and ReAct/Plan-and-Solve orchestration—that are not supported by the described implementation evidence in this file. This can mislead users or downstream agents into trusting fabricated research outputs, synthetic citations, or unverifiable claims, which is a security-relevant integrity issue even without direct code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.