ClawHub
Back to skill

Security audit

Deep Researcher Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent research assistant, but it repeatedly tells agents to bypass paywalls and route URLs through third-party services without adequate safeguards.

Install only if you are comfortable supervising its research behavior closely. Do not use it to bypass paywalls or access restricted content, and avoid giving it private, signed, internal, or token-bearing URLs. Store any optional API keys outside the repository or in a proper secret manager.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:49
Finding

Disclosure of Sensitive Target URLs to Third-Party Proxy and Archive Services

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-52
Vulnerability Type: Sensitive URL disclosure to third-party services
Risk Level: Medium

Vulnerable Code

markdown
1. **Try archive.org:** `https://webcache.googleusercontent.com/search?q=URL` or `https://archive.org/web/*/URL`
2. **Try 12ft.io:** `https://12ft.io/URL` (works for Medium, Substack, etc.)
3. **Try textise dot iitty:** `https://r.jina.ai/http://URL` (extracts article text)
4. **Use browser tool:** Navigate and extract text directly

The behavior is reinforced by the guardrail at SKILL.md, lines 519-525, which instructs the Agent to bypass paywalls before skipping inaccessible sources.

Technical Analysis

The Skill directs the Agent to embed a target URL inside requests sent to archive and content-proxy services. Consequently, the complete target URL becomes visible to those third parties and may be logged, retained, or dereferenced by them.

URLs can contain sensitive information, including signed query parameters, bearer tokens, private document identifiers, search terms, account identifiers, or internal hostnames. The instructions do not require the Agent to remove sensitive query parameters, reject private network addresses, restrict URL schemes, obtain user consent, or limit forwarding to known-public resources.

Using external research services is consistent with the declared research functionality, but forwarding complete URLs to additional intermediaries is not the minimum privilege necessary when direct retrieval is available. The risk is particularly significant for user-provided URLs whose confidentiality has not been assessed.

Attack Path

  1. A user supplies a URL for research, or the Agent discovers one during a search.
  2. The URL refers to inaccessible or paywalled content and contains a sensitive query parameter, signed access token, private path, or document identifier.
  3. Following the prescribed s ...[truncated 953 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make direct retrieval the default and use third-party proxies only after explicit user consent.
  2. Restrict proxying to public http and https URLs.
  3. Reject loopback, link-local, private-network, cloud-metadata, local-file, and non-HTTP destinations.
  4. Remove URL fragments, embedded credentials, signed parameters, session identifiers, and other sensitive query values before forwarding.
  5. Maintain an allowlist of approved intermediary services and disclose which service will receive the URL.
  6. Do not proxy authenticated, private, intranet, or user-specific resources.
  7. Add a mandatory sensitivity check before any target URL is disclosed to an external service.
  8. Prefer officially accessible summaries, licensed APIs, or user-provided content over paywall circumvention.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:416
Finding

API Keys Modeled as Plaintext Configuration Values

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 416-434
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Low

Vulnerable Code

markdown
## Configuration

### research-config.json
```json
{
  "apis": {
    "newsapi": {
      "key": "YOUR_NEWSAPI_KEY",
      "tier": "free"
    },
    "openweather": {
      "key": "YOUR_OPENWEATHER_KEY",
      "tier": "free"
    },
    "exchangerate": {
      "key": "YOUR_EXCHANGERATE_KEY",
      "tier": "free"
    }
  },

Technical Analysis

The documented configuration model encourages users to place API keys directly into a JSON file. Although the repository contains placeholders rather than live credentials, the example provides no environment-variable indirection, platform secret-store integration, restrictive file-permission guidance, source-control exclusion, or output-redaction requirements.

Users following the example may persist live keys in a readable file. Such a file could then be committed to source control, included in backups, copied during support requests, exposed to other local users, or read by tools and Agents with project-directory access.

No executable code in the audited project automatically transmits these keys, and no hardcoded live secret was found. The vulnerability is therefore an insecure configuration practice rather than confirmed active credential exfiltration.

Attack Path

  1. A user creates research-config.json using the documented template.
  2. The user replaces one or more placeholders with live API keys.
  3. The file is stored with default permissions or committed, archived, shared, or exposed to another tool.
  4. An unauthorized local user, repository reader, backup consumer, or Agent obtains the key.
  5. The exposed key is used to consume API quota, issue requests under the user's account, or access any data and operations permitted by the affected provider.

Imp

...[truncated 513 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace plaintext key values with environment-variable references or platform secret-manager identifiers.
  2. Document use of a supported credential store rather than storing secrets in the project directory.
  3. Add research-config.json and equivalent local secret files to .gitignore.
  4. If a local file is unavoidable, require owner-only permissions and keep it outside the repository.
  5. Validate configuration and reject placeholder or accidentally exposed values where practical.
  6. Redact credentials from logs, errors, prompts, generated reports, and research history.
  7. Request narrowly scoped API credentials and apply provider-side quota and usage restrictions.
  8. Provide key revocation and rotation instructions for suspected disclosure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to bypass paywalls using archive caches, 12ft.io, r.jina.ai-style extraction, and direct browser extraction. That goes beyond normal research assistance and encourages access-control circumvention, creating legal/compliance risk and normalizing policy-violating behavior by the agent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guardrails reinforce repeated paywall circumvention by telling the agent to bypass paywalls before skipping sources. Embedding this in the safety/guardrail section makes the unsafe behavior systematic and increases the likelihood the agent will treat circumvention as a required default action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill lists third-party APIs for news, weather, exchange rates, and country data but does not warn that user prompts, topics, or contextual/location-related queries may be transmitted to external services. This creates a privacy and transparency gap, especially when research queries may contain sensitive business, personal, or location information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill repeatedly promotes paywall-bypass techniques without any warning about legal, contractual, or ethical implications. Even aside from the bypass itself, omission of cautionary language increases the chance of unauthorized access attempts and misuse by users who may assume the behavior is acceptable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.