Deep Research Agent

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 11.0.0

Overview

This skill is a disclosed deep-research workflow with some broad web-research and packaging-script cautions, but I found no hidden execution, persistence, credential handling, or malicious behavior.

Install only if you want an agent to perform large, autonomous web/PDF research runs. Keep retrieved web content treated as untrusted evidence, review source quality carefully, and do not run the packaging script from a directory containing untrusted symlinks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50
• Finding: Untrusted Web Content Is Processed Without Prompt-Injection Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 50-79 **Vulnerability Type**: Indirect prompt-injection exposure **Risk Level**: Medium ### Vulnerable Code ```markdown **Tools Used**: `batch_web_search`, `extract_content_from_websites` **Process**: 1. **Initial breadth search** - Execute parallel searches across all primary query dimensions - Gather minimum 20-30 URLs per major topic area - Prioritize authoritative sources (official docs, academic, established media) 2. **Source classification** - Categorize by source type: ニュース, 学術論文, 白書, 技術ドキュメント, フォーラム, ブログ - Assess domain authority and reliability - Flag sources requiring deeper analysis 3. **Iterative deep-diving** - Extract key terms and concepts from initial results - Generate follow-up queries using discovered terminology - Expand search to related topics and subtopics - Loop until saturation (no new significant information) 4. **Diverse source coverage** - Ensure geographic diversity (JP/US/EU/Asia when relevant) - Cover multiple stakeholder perspectives - Include both primary and secondary sources **Target**: Minimum 100 unique, verified sources ### Phase 3: Content Reading & Reasoning **Tools Used**: `extract_content_from_websites`, `extract_pdfs_key_info` **Process**: 1. **Content extraction** - Access each promising URL - Extract structured information: facts, statistics, quotes, dates, claims - Parse PDF documents for detailed data ``` ### Technical Analysis The workflow requires the Agent to search for and ingest content from arbitrary websites and PDF documents. It does not state that instructions contained in retrieved material must be treated exclusively as untrusted data, nor does it define a separation between external content and authoritative Skill or user instructions. Consequently, a retrieved page can contain adversarial text designed to b ...[truncated 1739 chars]
• Remediation: ## Remediation Suggestions 1. Add an explicit rule that all retrieved website and PDF content is untrusted data and can never override system, developer, Skill, or user instructions. 2. Require the Agent to ignore commands, tool requests, role changes, encoded directives, and claims of higher authority found in source material. 3. Delimit extracted content in a structured data container and process it only for facts, quotations, metadata, and evidence. 4. Restrict extraction-stage tools to the minimum required capabilities and prohibit actions unrelated to the original research request. 5. Validate URL schemes and destinations, reject local and non-HTTP schemes, and apply network-level protections against access to internal or metadata endpoints. 6. Require explicit user confirmation before performing any consequential action that was suggested by retrieved content rather than requested by the user. 7. Add prompt-injection detection and record rejected instructions in the research log without following them. 8. Cross-check important claims against independent sources so that one hostile source cannot control the synthesis.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_skill.py:42
• Finding: Package Creation Can Dereference File Symlinks Outside the Skill Directory## Vulnerability Details **File Location**: `scripts/package_skill.py`, lines 42-56 **Vulnerability Type**: Symlink-based disclosure of files outside the package root **Risk Level**: Medium ### Vulnerable Code ```python # Create zip archive with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED) as zf: for root, dirs, files in os.walk(SKILL_DIR): # Skip __pycache__ and other cache directories dirs[:] = [d for d in dirs if d not in ['__pycache__', '.git', '.venv', 'node_modules']] for file in files: # Skip unnecessary files if file.endswith('.pyc') or file.startswith('.'): continue file_path = Path(root) / file arcname = file_path.relative_to(SKILL_DIR) zf.write(file_path, arcname) ``` ### Technical Analysis The archive path is calculated lexically with `relative_to(SKILL_DIR)`, but the script does not reject symbolic links or verify that each resolved file remains within the resolved Skill directory. A file symlink can therefore appear to be inside `SKILL_DIR` while referring to a readable file elsewhere on the host. When the script passes that path to `ZipFile.write()`, the target can be opened and its contents archived under the symlink's in-project relative name. The directory exclusion list and filename filters do not mitigate this issue because they do not inspect file type or resolved destination. Exploitation requires an attacker or compromised process to create or control a symlink within the project before an authorized user runs the packaging script. ### Attack Path 1. An attacker obtains the ability to add a file symlink within the Skill tree, for example `references/host-data.txt`. 2. The symlink points to a sensitive file readable by the user who will run the packaging script. 3. The user executes `scripts/package_skill.py`. 4. `os.walk()` reports the symlink as an in-tree file. ...[truncated 806 chars]
• Remediation: ## Remediation Suggestions 1. Reject symbolic links before archiving: ```python if file_path.is_symlink(): raise ValueError(f"Refusing to package symlink: {file_path}") ``` 2. Resolve both the package root and every candidate file, then verify containment: ```python root_resolved = SKILL_DIR.resolve(strict=True) resolved = file_path.resolve(strict=True) if not resolved.is_relative_to(root_resolved): raise ValueError(f"File escapes package root: {file_path}") ``` 3. Open and archive only the validated resolved regular file, and reject sockets, devices, FIFOs, and other special file types. 4. Prefer an explicit allowlist of expected package files and directories instead of recursively including nearly every file. 5. Perform the validation immediately before reading each file to reduce time-of-check to time-of-use exposure. 6. Build packages in an isolated environment with minimal filesystem permissions so that unrelated secrets are not readable even if validation fails. 7. Add automated tests covering file symlinks, directory symlinks, broken symlinks, and paths resolving outside the project root.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose describes an end-user research/analysis capability, but the actual code does not perform any research, source verification, report generation, querying, or analytical behavior. Instead, it is a build script for packaging the skill into a distributable .skill file by traversing directories, filtering files, and writing a zip archive. This is a materially different primary purpose and involves filesystem read/write behavior unrelated to the declared research-agent functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill performs substantive research and analysis tasks. However, the code chunk does not perform any research, information retrieval, analysis, reporting, or source verification. Its purpose is purely maintenance/validation of the skill's file layout and metadata. This is a materially different primary purpose, so the description does not accurately represent the actual behavior shown.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are very broad, including generic words like 'research', 'analysis', '調査して', and 'レポートを作成', which can cause unintended invocation on many unrelated user requests. Over-broad auto-activation is dangerous because it may route conversations into a high-autonomy, web-enabled workflow unexpectedly, increasing the chance of unnecessary external access, excessive tool use, or prompt-surface exposure.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The research plan template uses Japanese-only placeholder values such as "テーマ名" and "研究目的の詳細な説明", which signals an expectation that users operate in Japanese. Elsewhere the document mixes English and Japanese, but it does not offer a language choice or explain that the template is intended only for a Japan-specific context.

Static analysis

No suspicious patterns detected.