T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:434- Finding
Unnecessary Cross-Session Memory Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Deep Research
Security checks for vulnerabilities and agentic risk
Overview
This research skill mostly matches its stated purpose, but it under-discloses external web use and automatically reaches into prior memory during a high-autonomy workflow.
Install only if you are comfortable approving a high-autonomy research workflow that will search and fetch from the web, may spawn parallel sub-agents, may write research files locally, and may consult prior agent memory. Avoid using it with confidential topics, personal identifiers, credentials, health data, proprietary project names, or sensitive internal incidents unless memory access and outbound web queries are explicitly controlled by the host environment.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:9- Finding
Misleading Offline Claim Despite Mandatory Network Research
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises very broad invocation phrases such as "deep research on..." and "exhaustive analysis of...", which can cause the skill to be triggered unintentionally from ordinary user language rather than an explicit command. In an agent environment, accidental invocation can launch a high-autonomy research workflow, increasing the chance of unintended tool use, file writes, or bypass of the user's expected interaction flow.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest presents file writing as a reliability workaround, but the body of the skill goes further by instructing directory listing and direct reading of discovered files. This mismatch understates the real capability to access local data, which can mislead users and reviewers and increases the chance that filesystem access is used in contexts where it is not necessary for research.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises that sub-agents write research files but does not provide a clear user-facing warning that local filesystem modification will occur. Hidden or non-obvious file writes undermine informed consent and can surprise users, especially in environments where local files may be sensitive or subject to policy constraints.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to activate on common requests such as 'tell me everything about X,' increasing the chance the skill runs in situations where its heavier behaviors, including spawning sub-agents and file-based workflows, are unnecessary. Overbroad activation is risky because it enlarges the exposure surface for the skill’s more sensitive capabilities without clear user intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs sub-agents to persist outputs to local files and then instructs the main agent to enumerate the
research/directory and read discovered files. That expands the skill from web research into filesystem interaction and creates an unnecessary data-access pathway that could expose unrelated local content, enable prompt-injection via file contents, or normalize broad file reads beyond the user’s expectation.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The skill explicitly designates a phase as 'Auto-Execute,' indicating the agent may proceed with external research actions without an additional user confirmation gate. In an agent setting, autonomous execution can cause unintended web access, excessive tool use, or action on misunderstood scope, which is especially sensitive when researching regulated topics like healthcare security.
- Content
md --- ## Phase 3: Research Cycles (Auto-Execute) ### Theme 1: Market Landscape — Cycle 1
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation guidance includes broad natural-language triggers such as mentioning "deep research" or "exhaustive analysis," which can cause the skill to activate during ordinary conversation rather than through an explicit command. Because this skill proceeds into fully automated web-research behavior after limited checkpoints, accidental triggering could launch unintended external actions, consume resources, and generate research output the user did not clearly authorize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The phase description states that execution is "fully automated" and directs tool-driven web research, but the document does not prominently warn users that external web actions will be performed on their behalf. This weakens informed consent and increases the chance that users approve the skill without understanding that it will autonomously search and fetch external content, which can create privacy, safety, and cost risks.
- Content
Static analysis
No suspicious patterns detected.