Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward research-update helper that searches for configured topics and keeps local state to avoid repeat reports.
Before installing, be aware that the skill stores your research topics, seen-item identifiers, and last checked date locally in research_config.json. Review or delete that file if the topics reveal confidential projects or strategic interests.
The skill is described as a research-monitoring utility, but its workflow also performs undeclared local configuration storage and state management through files and helper scripts. This mismatch is dangerous because users and policy systems may approve the skill expecting passive monitoring while it also writes persistent local data, reducing informed consent and weakening security review.
The invocation phrase "check for research updates" is generic and does not clearly limit what sources, topics, or actions are in scope. In an agent setting, overly broad triggers can cause the skill to activate unexpectedly or perform monitoring beyond the user's intended research areas, increasing the chance of unintended data access or noisy autonomous behavior.
The skill instructs reading and updating local state (research_config.json) and invoking scripts that persist data, but it declares no explicit tool scope or permissions. This creates an authorization/transparency gap: an agent may perform file read/write operations that are not clearly disclosed or constrained, increasing the risk of unintended access or modification of local data.
The README mentions that preferences are stored in research_config.json but does not clearly warn users that the skill persists local configuration data. This can lead to uninformed use in environments where local files may be shared, backed up, or inspected by other tools, creating a privacy and transparency issue even if the stored data is limited to preferences.
The skill tells the agent to save user research topics locally without warning that the information will be persisted. Even if research topics are usually low sensitivity, they can reveal professional interests, confidential projects, or strategic priorities, so silent retention creates a privacy risk.
No suspicious patterns detected.
