Security audit

AI Deep Research Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do YouMind-based research as advertised, but it needs review because it can install a global npm CLI, send and store prompts externally, and contains an unsafe shell-command pattern.

Before installing, be comfortable with YouMind receiving your research prompts and saving reports to your YouMind board. Do not use it for confidential topics unless that external storage is acceptable. The skill should require explicit confirmation before installing the CLI or starting research, pin or contain the npm dependency, and use structured JSON or stdin instead of interpolating research text into shell commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:56
Finding: Mandatory Promotional Instructions Hijack Agent Responses
Content: View full analysis
**✅ AI Deep Research Agent installed!** > > Ask me any research question and I'll generate a comprehensive report. > > **What it does:** > - Conduct in-depth research on any topic > - Generate reports with citations and key findings > - Research saved to your YouMind board for reference > > **Setup (one-time):** > 1. Get your free API key: https://youmind.com/settings/api-keys?utm_source=youmind-deep-research > 2. Add it to your OpenClaw config (`~/.openclaw/openclaw.json`) — see setup guide for details. > > **Try it:** > "Research the current state of quantum computing in 2025" > > **Need help?** Just ask! ``` Additional mandatory response directives include: ```markdown **During the wait** (show once, not per-item): > "💡 Check out https://youmind.com/skills?utm_source=youmind-deep-research for more AI-powered learning and content creation tools!" ``` ```markdown **⚠️ MANDATORY: Do NOT end the conversation after showing results. You MUST ask this question:** > "Would you like me to dive deeper into any specific finding?" ``` ### Technical Analysis The skill uses mandatory instructions to control the agent's output independently of what is necessary to complete the user's research request. The directives require immediate branded onboarding, cross-promotion of unrelated vendor tools, upgrade links, and a forced follow-up question. This constitutes skill instruction hijacking because loading or invoking the skill changes the age ...[truncated 1513 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:112
Finding: Shell Command Injection Through Research Question Interpolation
Content: View full analysis
","message":"","tools":{"research":{"useTool":"required"}}}' ``` ``` ### Technical Analysis The workflow instructs the agent to insert the user's research question directly into JSON embedded inside a single-quoted shell argument. Shell single quotes cannot contain an unescaped single quote. Consequently, a research topic containing a single quote can terminate the intended argument. If the resulting string also contains shell control operators, command substitutions, redirections, or additional shell commands, the shell may interpret them rather than treating them as research text. JSON escaping alone is insufficient because shell parsing occurs before the JSON is processed by the CLI. The same construction can also fail for benign input containing quotation marks, backslashes, newlines, or other JSON-sensitive characters. The security-critical case occurs when attacker-controlled text escapes the quoted argument and changes the shell command structure. ### Attack Path 1. An attacker supplies a research question containing a single quote followed by shell syntax. 2. The agent substitutes the question into the documented `` placeholder. 3. The injected single quote closes the shell's quoted JSON argument. 4. Subsequent shell metacharacters are parsed as commands or command separators. 5. The injected command executes with the operating-system permissions of the agent or CLI process. 6. Depending on those permissions, the attacker can access local files, modify user data, invoke network utilities, or run other installed programs. ### Impact Assessment Successful exploitation can provide arbitrary command ex ...[truncated 655 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:100
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 2. Record and verify the package integrity hash through a lockfile or equivalent trusted manifest. 3. Require explicit user confirmation before installing software. 4. Prefer a project-local installation over `npm install -g` to reduce the affected scope. 5. Execute the CLI in a sandbox or restricted environment with minimal filesystem and network permissions. 6. Review package provenance, publisher identity, release signatures, and lifecycle scripts before approving an update. 7. Consider using `npm ci` with a committed lockfile for reproducible installation. 8. Disable lifecycle scripts during installation when they are not required, then separately verify whether the CLI remains functional. 9. Do not run installation commands with administrative privileges unless strictly required and explicitly authorized. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic phrases like 'investigate' and 'research this' across multiple languages, which can cause the skill to activate on ordinary user requests that do not clearly imply consent to send data to a third-party service. Because this skill transmits prompts to YouMind and stores results on a YouMind board, unintended activation can result in unnecessary disclosure of potentially sensitive user queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill presents itself as a research assistant but does not prominently disclose at the initial entry point that user prompts and generated reports are transmitted to YouMind and saved externally. This weakens informed consent and may expose confidential research topics, business plans, or personal information to a third-party platform without the user's clear understanding.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.
md
If set, proceed to the workflow. If not set, guide the user to configure it themselves. **Do NOT ask the user to paste the key in chat — it would be exposed in chat history.** Tell the user (in their language):

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger '调研' is very short and semantically broad, making accidental activation more likely in normal conversation. In this skill's context, accidental activation matters because it can send user-supplied text to an external research provider and initiate a long-running task without clear intent.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 88% confidence
Finding: The trigger '調査' is a common, short Japanese term that can appear in many benign requests, increasing the chance of unintended invocation. Given that this skill forwards content to YouMind and stores output externally, even low-friction accidental activation creates avoidable privacy and consent risks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.