Chonkie DeepResearch

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:20 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a coherent external research integration, but it asks users to create recurring cron monitoring and uses unsafe mutable install instructions without enough scoping or cleanup.

Install only if you are comfortable sending research prompts and related context to Chonkie. Avoid putting secrets or regulated data in queries, store CHONKIE_API_KEY securely, prefer a pinned and verified chdr/Rust installation path, and do not create the suggested cron job unless you also define cleanup and explicitly approve the persistent scheduler change.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` ### Technical Analysis The setup instructions stream content retrieved from `https://sh.rustup.rs` directly into `sh`. Although HTTPS and TLS 1.2 reduce transport interception risks, they do not provide version pinning or independent payload integrity verification. The effective code executed by this instruction can therefore change after the Skill has been reviewed. This behavior is not the minimum privilege or minimum-risk approach needed to install Rust. A package manager or a separately downloaded, versioned, and cryptographically verified installer could provide the required dependency without immediately interpreting mutable network content. A compromise of the remote service, delivery infrastructure, DNS or certificate trust chain could cause arbitrary shell commands to run with the permissions of the user executing the setup instruction. ### Attack Path 1. A user or agent determines that `cargo` is unavailable. 2. It follows the Skill's setup instructions and invokes the `curl` command. 3. The response from the external server is passed directly to `sh` without local review, version pinning, checksum validation, or signature verification. 4. If the returned installer has been maliciously modified, its commands execute immediately. 5. The payload can access files, credentials, processes, and configuration available to the invoking account and may install additional software or modify shell configuration. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the invoking user. The resulting scope may include reading or changing user-owned files, accessing environment variables and locally available credentials, modifying shell startup files, installing exe ...[truncated 243 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the direct download-to-shell pipeline. - Prefer installation through a trusted operating-system package manager where available. - If the upstream installer is required: 1. Download it to a local file without executing it. 2. Pin an explicitly reviewed installer version. 3. Validate a checksum or cryptographic signature published through an independent trusted channel. 4. Allow the user to inspect the script before execution. 5. Execute it only after explicit user approval and without elevated privileges. - Document the files and configuration that the installer is expected to modify. - Avoid automatically requesting `sudo` or running setup from a privileged account. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24
• Finding: Unpinned Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24` **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Install: `cargo install chdr` ``` ### Technical Analysis The command installs the registry version selected at installation time without specifying an exact version, a locked dependency graph, a source revision, or an integrity-verification procedure. Consequently, installations are not reproducible and a future package release may execute code that was not included in this audit. Cargo packages may execute build scripts during compilation. The resulting `chdr` executable also handles research queries and may receive the `CHONKIE_API_KEY` environment variable. A compromised package release or dependency could therefore execute locally during installation or access sensitive information when the CLI is subsequently used. The audit found no evidence that the current `chdr` package is malicious. The vulnerability is the unsafe, mutable dependency installation process. ### Attack Path 1. An attacker compromises the package publisher, registry account, package source, or a transitive dependency. 2. A malicious new release becomes the version resolved by `cargo install chdr`. 3. A user or agent follows the Skill instructions after that release is published. 4. Cargo downloads and builds the unreviewed version; malicious build-time code may execute during installation. 5. The installed binary may later receive the user's API key and research queries when authentication or research commands are used. ### Impact Assessment A compromised package or build dependency could execute code with the invoking user's privileges. It could access user-owned files and environment variables, alter installed executables, or capture the Chonkie API key and submitted research content. The command does not inherently grant administrative privileges, but running it as a privileged account would expa ...[truncated 26 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `chdr` to an explicitly audited version, for example: ```bash cargo install chdr --version <audited-exact-version> --locked ``` - Verify that the selected version is published by the expected maintainer and corresponds to the documented source repository. - Review package build scripts and relevant transitive dependencies before approving the version. - Document a controlled update process that requires review before changing the pinned version. - Where feasible, publish and verify cryptographic checksums or signatures for distributed binaries. - Run installation and the CLI as an unprivileged user and expose the API key only to the process that requires it. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:57
• Finding: Recurring Cron Job Recommended Without Lifecycle Cleanup<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-64` **Vulnerability Type**: Persistent scheduled-task creation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Monitoring research status **Do NOT poll continuously for status.** Instead, set up a cron job to check periodically (every 2-3 minutes): ```bash # Add a cron entry to check research status every 2 minutes # The cron should run: chdr view <id> --json | python3 -c "import json,sys; d=json.load(sys.stdin); s=d.get('status','unknown'); print(s)" # and notify you when status is 'completed' or 'failed' ``` ``` ### Technical Analysis The Skill recommends creating a recurring cron entry to monitor a one-off research operation. Cron entries survive the current process and agent session, but the instructions do not define a timeout, removal procedure, unique job identifier, or cleanup behavior after completion or failure. A persistent scheduler is unnecessary for the declared functionality because the Skill already recommends a sub-agent that announces completion. A bounded polling loop in the active process could also monitor status without modifying persistent user configuration. The shown shell block is explanatory rather than an executable cron-installation command. Therefore, exploitation requires a user or agent to translate the recommendation into an actual cron entry. Once created, however, the task can continue invoking the externally installed `chdr` executable beyond the intended research session. ### Attack Path 1. A research request is submitted and receives an identifier. 2. A user or agent follows the monitoring recommendation and creates a recurring cron entry. 3. The job invokes `chdr view <id> --json` every few minutes under the user's account. 4. The research operation completes or fails, but no documented cleanup action removes the entry. 5. The scheduled task continues to execute across sessions. If the `chdr` executable is later replaced or compromised, ...[truncated 559 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the cron recommendation for one-off research operations. - Prefer the already documented sub-agent completion notification. - If sub-agents are unavailable, use a bounded polling loop that: - runs only inside the active process; - uses a reasonable polling interval; - has a fixed timeout; - exits on completion, failure, interruption, or authentication error. - If persistent scheduling is unavoidable, create a uniquely named one-shot job and automatically remove it after completion, failure, or timeout. - Obtain explicit user consent before changing cron configuration. - Document how to identify and manually remove any scheduled entry. - Execute monitoring under an unprivileged account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to authenticate via browser login or by setting `CHONKIE_API_KEY`, but it gives no warning about safe credential handling, storage, or avoiding exposure in logs and shared environments. This can lead to accidental leakage of API secrets during setup or later command execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The core workflow sends user-supplied research queries and receives report content from an external service, but the skill does not clearly warn that prompts, embedded data, or sensitive business context will leave the local environment. This creates a real privacy and data-governance risk, especially for confidential or regulated information.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends creating a cron job to monitor research status, which introduces persistent scheduled execution outside the core one-shot research task. Persistent jobs can outlive the user’s intent, create unnecessary background activity, and expand the operational footprint of the skill beyond what is needed.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Do NOT poll continuously for status.** Instead, set up a cron job to check periodically (every 2-3 minutes):

```bash
# Add a cron entry to check research status every 2 minutes
# The cron should run: chdr view <id> --json | python3 -c "import json,sys; d=json.load(sys.stdin); s=d.get('status','unknown'); print(s)"
# and notify you when status is 'completed' or 'failed'
```

• Confidence: 96% confidence
• Finding: The instruction to add a cron entry creates session persistence through recurring background execution, which is broader than necessary for checking a single research task. Such persistence can linger unnoticed, consume resources, and create an avenue for repeated external access or notifications beyond the original task scope.

External Script Fetching

Low

• Category: Supply Chain

Content

Before using, check if `chdr` is installed (`which chdr`). If not:

1. Install: `cargo install chdr`
   - If `cargo` isn't available, install Rust first: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`
2. Authenticate: `chdr auth login` (opens browser to get an API key)
   - Or set `CHONKIE_API_KEY` environment variable
   - Get a key at https://labs.chonkie.ai/settings/api-keys

• Confidence: 84% confidence
• Finding: The setup path recommends piping a remote script directly into `sh`, which bypasses inspection and executes code fetched over the network immediately. Even with TLS, this pattern increases supply-chain risk because compromise of the remote source or transport path would lead to arbitrary code execution on the host.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest frames the skill as a way to run research and return comprehensive reports with citations. Advertising deletion of reports extends the skill into lifecycle management of remote research artifacts, which is not needed for the stated read/report use case.

Static analysis

No suspicious patterns detected.