Academic Deep Research

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent deep-research workflow, but it tells the agent to search and retrieve persistent memory without a separate, scoped user approval step.

Install only if you are comfortable with the agent reusing prior persistent memory during research. Prefer running it in an environment where memory tools are disabled or scoped to the current user/project, or require the agent to ask before searching or retrieving memory records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:457

Finding

Unscoped Cross-Session Memory Access Without Explicit User Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 457-470
Vulnerability Type: Cross-session memory access exceeding least privilege
Risk Level: Medium
Classification: T05: Unauthorized Access and Privilege Escalation

Vulnerable Code Snippet

markdown

### Memory Search Integration

Before starting research, check for relevant prior knowledge:

\`\`\`
→ memory_search(query="previous research on [topic]")
→ memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]
\`\`\`

Use prior findings to:
- Avoid duplicate research
- Build on previous conclusions
- Identify how understanding has evolved
- Note persistent gaps from prior research

The memory tools are also declared in SKILL.md, line 30:

markdown

| `memory_search` / `memory_get` | Cross-reference prior knowledge | Check MEMORY.md for related context |

Technical Analysis

The Skill instructs the agent to search persistent memory and retrieve matching historical memory files before beginning research. This behavior is not limited to records created for the current task, conversation, or user, and the Skill does not require separate user approval before accessing those records.

Persistent agent memory may contain confidential topics, personal information, organizational context, or conclusions from unrelated sessions. A broad query such as previous research on [topic] can locate records that happen to share keywords with the current request. The subsequent memory_get call reads the matching file in full or in part, allowing unrelated historical context to affect the current report.

This exceeds the minimum privileges necessary for the declared web-research functionality. Web search and source retrieval can operate without reading cross-session memory. The existing planning checkpoint does not adequately mitigate the issue because the Skill does not require the proposed plan to disclose the exact memory query, matching paths, intended fields, or pri ...[truncated 1773 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory memory access from the default research workflow. The Skill should remain functional using only the current conversation, web_search, and web_fetch.
2. Make persistent-memory access explicitly opt-in. Before calling either memory tool, explain why access is useful, what query will be executed, and what categories of historical data may be returned.
3. Require a dedicated approval checkpoint for memory retrieval rather than treating general approval of the research plan as consent.
4. Restrict searches to a task-scoped or user-scoped namespace enforced by the host platform. Do not rely only on topic keywords as an access-control mechanism.
5. Display matching memory paths and minimal metadata first. Require confirmation before calling memory_get on any record.
6. Retrieve only the minimum necessary excerpt rather than an entire dated memory file.
7. Add an explicit prohibition against placing memory-derived confidential information, identifiers, proprietary text, or personal data into web_search or web_fetch requests without separate approval.
8. Label memory-derived claims in the report and allow the user to exclude them.
9. If reliable user or task isolation cannot be guaranteed, disable memory_search and memory_get for this Skill.

A safer replacement would be:

markdown

Persistent-memory access is disabled by default. If prior research may be
helpful, ask the user for explicit permission and disclose the exact scoped
query. Search only memory belonging to the current user and project. Show
matching record metadata before retrieval, retrieve only approved excerpts,
and never include memory-derived sensitive data in network requests without
separate consent.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README advertises broad trigger phrases such as asking for "deep research on..." or "exhaustive analysis of...", which can cause the skill to be invoked unintentionally from ordinary user language rather than an explicit command. In an agent ecosystem, this increases the chance of accidental tool activation, unnecessary web access, and execution of a long multi-step workflow without the user clearly intending to call this specific skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger guidance includes the phrase "Tell me everything about X," which is a broad, everyday expression rather than a distinctive invocation condition. This can cause the skill to activate unintentionally in normal conversation, leading to unexpected web access, parallel session spawning, and extensive research behavior the user did not explicitly request.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The workflow explicitly labels Phase 3 as 'Auto-Execute' and shows the agent proceeding through research cycles and tool usage without an intervening user approval gate. In a skill that uses external search/fetch tools, this creates autonomous action risk: the agent may perform network activity, gather or amplify untrusted content, and continue analysis beyond the user's intended scope without confirmation at each stage.

Content

Scanner excerpt · example.md (reported line 76)May include surrounding context.

md

---

## Phase 3: Research Cycles (Auto-Execute)

### Theme 1: Market Landscape — Cycle 1

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance is overly broad because it triggers on generic conversational phrases like "deep research" or "exhaustive analysis," which can appear in normal user requests without deliberate intent to invoke this skill. That increases the chance of accidental activation, causing the agent to enter this skill’s rigid workflow and potentially perform extensive automated web activity or change response behavior unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.