Deep Research Forge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent deep-research helper, but it also contains under-disclosed local automation for persistent research state, skill iteration, file changes, and arbitrary evaluator command execution.

Install only if you want a Chinese-first, evidence-heavy research workflow and are comfortable reviewing when it tries to use multi-agent execution or local validation scripts. Treat the retrospective/iteration workflow as developer-maintenance tooling: do not let it run evaluator commands, write .skill-iterations state, edit skill files, update VERSION, or preserve cross-session research state unless you explicitly asked for that and understand what files and commands will be used.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user-facing deep research and decision-analysis capability. The supplied code does not implement research, evidence synthesis, timelines, competitor analysis, multi-agent orchestration, or report generation about external subjects. Its primary purpose is operational tooling for maintaining/improving a skill: loading feedback JSON, listing pending fixes, running benchmark scripts and optional behavioral evaluator subprocesses, comparing baseline vs post-change scores, and saving iteration history. This is a materially different purpose and includes undeclared capabilities such as filesystem manipulation and subprocess execution. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个“深度研究与决策分析”执行型 skill，核心应是开展研究、组织证据、并行分析并产出结论。代码却并未实现研究流程本身，而是对研究产物进行静态校验：检查证据账本字段、任务状态转移、质量门禁、冲突解决结构、JSON Schema，以及 Markdown 中的证据引用、置信度、反转条件、空话词和来源链接等。这是明显不同的主要用途。虽然它与‘深度研究’领域相关，可视为研究系统的配套质检工具，但不足以支撑声明中的核心能力，因此属于实质性描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a user-facing deep research and decision-analysis capability, including methodology selection, evidence gathering, multi-agent research decomposition, and generation of research outputs. The supplied code does none of that. Instead, it is a narrow internal test runner for a linting/validation tool related to research-output schemas and markdown briefs. While the fixtures and linter are thematically connected to research artifacts, this script’s primary purpose is automated validation/testing, not conducting research, analyzing companies/products, or producing decision support. That is a material purpose mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises very broad trigger phrases like '研究一下', '深度分析', '帮我搞懂', and '值不值得关注/投入/学习/跟进', which overlap with common user requests. This can cause the skill to activate in situations outside its intended scope, unexpectedly steering conversations into its own methodology and potentially displacing more appropriate safeguards or domain-specific handling.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/claim-citation-protocol.md (reported line 41)May include surrounding context.

md

- `user-signal-only`: community or review evidence supports experience, not official fact.
- `unsupported-gap`: claim is important but not yet supported.

## Output Rules

- Put evidence IDs next to key claims when the answer is more than a short explainer.
- For policy, standard, exam, legal, financial, medical, pricing, or fast-moving product claims, include a compact claim citation map.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill content, description, workflow, and example utterances are entirely in Chinese, with no indication that users may choose another language or locale. This can constitute a language policy issue if the organization expects language choice rather than a fixed language by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage scenarios list ambiguous examples such as '帮我摸清楚', '研究一下这个来头', and '横纵分析' without clear boundaries, increasing the chance of overbroad or accidental activation. In a skill that can recommend actions and orchestrate multi-agent work, unnecessary invocation can amplify errors, consume resources, and bypass better-scoped workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Several trigger phrases such as broad research/help requests can match ordinary user language and cause the skill to activate when the user did not explicitly ask for this specific capability. In a skill that can steer methodology and potentially invoke parallel research behavior, ambiguous activation increases the risk of unintended execution, scope expansion, and user confusion about what tool is operating.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger set includes phrases suggesting split investigation or multi-agent research, but it does not define clear thresholds or confirmation requirements for when parallel behavior is permitted. This can lead to unintended escalation into more complex autonomous behavior, increasing resource use, inconsistent outputs, and loss of user control over execution mode.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The few-shot examples present user prompts and expected outputs only in Chinese, which can steer the agent toward responding in Chinese by default even when the user has not expressed a language preference. This can degrade usability, cause misunderstanding, and create exclusion or policy-compliance issues in multilingual deployments, especially for users expecting locale-sensitive behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown template is written as a standard VerificationReport template, but the instructional content is presented in Chinese without any indication that language selection is optional. The policy requires flagging skills that force a specific language or locale unless the constraint is explicitly justified or user opt-in is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This JSON eval file contains multiple prompt and expected-output strings written entirely in Chinese for generic skill behavior, including refusal and clarification cases. The file does not indicate that the skill is region-specific or that language choice is optional, so these examples encode a locale preference that could propagate into behavior without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file is written almost entirely in Chinese and presents operational instructions in that language without any opt-in, alternative locale, or stated region-specific justification. Under the language/locale policy rule, this is a natural-language policy concern because it effectively constrains use to a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The required structured section and operational instructions are partially specified in Chinese, including field descriptions and workflow guidance, which imposes a language/locale choice not offered to the user. The file does not document this as a justified locale-specific constraint or provide an English alternative or opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The protocol crosses from retrospective analysis into operational self-modification: it tells the agent to persist data, invoke tooling, compare benchmarks, update versioned artifacts, and mark changes as committable. In an agent setting, that expands authority from analysis to acting on the local environment and codebase, creating a path for unauthorized file writes and workflow manipulation beyond the user's immediate request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly instructs execution of local Python scripts and arbitrary behavior-evaluation commands, including parameterized command strings. That is dangerous because agent-controlled command execution can trigger unintended code execution, data exposure, environment probing, or supply-chain abuse, especially when the commands are framed as part of normal skill behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The protocol directs the agent to write retrospective data into a persistent .skill-iterations/ workspace without any notice, consent, retention policy, or sensitivity check. Silent persistence is risky because user prompts, model judgments, and potentially sensitive project context may be stored on disk unexpectedly and later reused or exposed.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/source-strategy.md (reported line 14)May include surrounding context.

md

| Open-source project | repository, releases, issues, maintainer docs, package stats | downstream adopters, forks, security advisories, community discussions | mistaking stars or hype for active production use |
| Person | primary writing, talks, interviews, official role pages | profiles, criticism, public records, timeline corroboration | flattening the person into one viral quote |
| Concept / technology | papers, standards, docs, early usage, naming history | adjacent concepts, debates, adoption examples, failed alternatives | writing a clean origin story where the record is messy |
| Market / category | official statistics, market reports with methodology, filings | buyer interviews, vendor pages, pricing, community complaints | accepting market-size numbers without checking definitions |
| Cultural phenomenon | primary artifacts, publication dates, creator statements | platform metrics, criticism, community reception, regional variants | treating one platform's discourse as the whole phenomenon |

## Minimum Evidence Sets

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script exposes a general-purpose execution surface through --behavior-command that is unrelated to the end-user research functionality and can be abused to run arbitrary local code. In a skill ecosystem, this increases the blast radius because users may treat repository tooling as trusted and run suggested commands without realizing they grant code-execution capability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This subprocess call executes a user-supplied --behavior-command after only shlex parsing and placeholder substitution, which still permits arbitrary program execution by anyone invoking the script. Although shell metacharacter injection is reduced by avoiding shell=True, the feature is explicitly designed to run attacker-chosen binaries or scripts, making it dangerous in any environment where invocation parameters are not fully trusted.

Content

Scanner excerpt · scripts/iterate_skill.py (reported line 190)May include surrounding context.

python

print(f"  Running behavioral evaluator ({phase}): {' '.join(argv)}")
        try:
            result = subprocess.run(
                argv,
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/iterate_skill.py (reported line 339)May include surrounding context.

python

print(f"  Running: {' '.join(cmd)}")
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains natural-language docstrings and operational messages primarily in Chinese, including the main script description and usage notes. Because the file does not offer users a language/locale choice or justify a Chinese-only audience, it creates a language-policy concern under the rule for natural-language policy violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The trigger set mixes Chinese and English phrases but does not state whether users may invoke the skill in other languages or whether the language set is intentionally limited. This can be a natural-language policy concern because the skill appears to privilege specific languages without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown template presents its instructional content in Chinese and does not offer an alternative language or state that the skill is intended only for a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.