Deep Research Forge

• Outcome: Review
• Latest audit: Aug 8, 2026 · 8:19 AM UTC
• Version: 0.1.0

Overview

This skill is mostly a deep-research assistant, but it also includes persistent self-improvement and command-execution workflows that should be reviewed before installation.

Install only if you are comfortable with a research skill that may coordinate multiple agents, persist research/iteration state under .skill-iterations, and expose local maintainer scripts. Do not run the retrospective iteration workflow or --behavior-command with untrusted commands, and prefer explicit confirmation before parallel research or any file-changing improvement loop.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  Running behavioral evaluator ({phase}): {' '.join(argv)}")
        try:
            result = subprocess.run(
                argv,
                capture_output=True,
                text=True,

• Confidence: 93% confidence
• Finding: result = subprocess.run( argv, capture_output=True, text=True, timeout=300, cwd=str(SKILL_DIR.parent),

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill text references operational behaviors that imply file access, file writing, and shell/subprocess execution, yet no permissions are declared. This creates a dangerous transparency and consent gap: a caller may invoke what appears to be a research-only skill while it can perform local side effects or command execution, increasing the risk of unintended file modification or execution of attacker-influenced commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a true description-behavior mismatch: the skill is presented as a deep research/analysis tool, but the detected behavior includes reading iteration files, running external benchmark/evaluator scripts, invoking subprocesses, and validating local artifacts. A mismatch like this is dangerous because users and orchestrators may route sensitive prompts into a skill that performs local execution and stateful actions outside the expected research scope.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The protocol explicitly instructs persisting ResearchCycleReport files under `.skill-iterations/` and resuming unfinished sprints in later sessions. That creates cross-session state retention beyond the core purpose of producing a research answer, and can retain user-derived content, task context, or sensitive evidence longer than necessary. In a research skill, this is more dangerous because topics may include companies, people, strategic decisions, or other sensitive material that users may reasonably expect to remain session-scoped.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The protocol explicitly instructs the agent to write files and execute local Python automation plus a caller-supplied behavior command. That crosses from retrospective analysis into operational code execution, creating a path for arbitrary command execution, filesystem modification, and unintended benchmark or script invocation if an agent follows the document literally.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file presents a 'retrospective' as a compact review task but then expands it into persistent state changes, version updates, rollback handling, and an automated improvement workflow. This kind of scope expansion can cause an agent to exceed least privilege, mutate repository state, and perform actions unrelated to simply analyzing research quality.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match common requests such as '研究一下', '帮我搞懂', or '深度分析', making accidental or overbroad activation more likely. In context, this is more dangerous because the skill appears capable of broader execution behaviors than a normal research skill, so misrouting ordinary user requests could expose files, invoke tools, or launch workflows the user did not intend.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The usage scenarios describe ambiguous activation conditions without tight boundaries, which can cause the skill to activate for loosely related tasks. Given the presence of implied multi-agent orchestration and local execution behaviors, ambiguous routing increases the chance of unintended tool use, unnecessary data access, and expansion of task scope beyond user consent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger set includes broad, natural-language phrases such as '帮我摸清楚' and '这次实测效果如何' that can match ordinary user requests outside the intended deep-research workflow. This can cause the skill to activate unexpectedly, routing benign conversations into a more powerful research process and increasing the chance of unintended tool use, prompt hijacking exposure, or confusing behavior.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation signals are broad enough to trigger multi-agent mode from ordinary phrases like 'team', 'parallel', or '分头查', and also from loosely defined task characteristics. Over-broad activation can cause unnecessary escalation in capability, more tool calls, more data sharing across sub-agents, and higher cost or privacy exposure without clear user intent. In this skill, that matters because research tasks often aggregate many sources and may involve sensitive or proprietary topics.

Unvalidated Output Injection

High

• Category: Output Handling

Content

print(f"  Running behavioral evaluator ({phase}): {' '.join(argv)}")
        try:
            result = subprocess.run(
                argv,
                capture_output=True,
                text=True,

• Confidence: 91% confidence
• Finding: subprocess.run( argv, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.