OpenAI Deep Research Skill

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 0.1.0

Overview

This skill does what it claims: runs OpenAI-powered research, optionally with web search, and writes local report artifacts, with no evidence of hidden persistence, destructive behavior, or exfiltration beyond the configured API workflow.

Install only in an environment where using the OpenAI SDK is acceptable, pin or review the dependency if reproducibility matters, avoid confidential topics unless the configured API and web-search providers may receive them, and use --disable-web-search or --dry-run for sensitive or test runs. Do not set OPENAI_BASE_URL unless it points to a trusted compatible gateway.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deep_research.py:101

Finding

Unrestricted Custom API Endpoint Can Receive Credentials and Research Data

Content

View full analysis

Vulnerability Details

File Location: scripts/deep_research.py:101-109, 218-233, 878
Vulnerability Type: Unvalidated credential-bearing API endpoint configuration
Risk Level: Medium

Complete Code Snippet

python

parser.add_argument(
    "--api-key",
    default=os.getenv("OPENAI_API_KEY", ""),
    help="OpenAI API key. Defaults to OPENAI_API_KEY environment variable.",
)
parser.add_argument(
    "--base-url",
    default=os.getenv("OPENAI_BASE_URL", ""),
    help="Optional custom OpenAI-compatible endpoint.",
)

python

def load_openai_client(api_key: str, base_url: str, timeout: float) -> Any:
    if not api_key:
        raise DeepResearchError("Missing API key. Set OPENAI_API_KEY or pass --api-key.")

    try:
        from openai import OpenAI  # type: ignore
    except ImportError as exc:
        raise DeepResearchError(
            "Dependency missing: openai package is not installed. "
            "Run: pip install -r scripts/requirements.txt"
        ) from exc

    kwargs: Dict[str, Any] = {"api_key": api_key}
    if base_url:
        kwargs["base_url"] = base_url

    try:
        kwargs["timeout"] = timeout
        return OpenAI(**kwargs)
    except TypeError:
        kwargs.pop("timeout", None)
        return OpenAI(**kwargs)

python

client = load_openai_client(args.api_key, args.base_url, args.timeout)

Technical Analysis

The application accepts an arbitrary API base URL from either the --base-url command-line option or the inherited OPENAI_BASE_URL environment variable. It then configures the OpenAI client with both that endpoint and the API key without enforcing HTTPS, validating the destination hostname, applying an allowlist, or warning the user that credentials and submitted content will be sent to a non-default server.

Consequently, a malicious launcher, poisoned environment, unsafe wrapper script, or copied command can redirect authenticated API requests to an attacker-controlled OpenAI-compat ...[truncated 1587 chars]

Remediation

View remediation

Remediation Suggestions

1. Default exclusively to the official API endpoint and do not inherit OPENAI_BASE_URL automatically.
2. Require a separate explicit opt-in flag before permitting custom gateways.
3. Parse and validate custom URLs before client creation:
   • Require HTTPS.
   • Reject embedded user information.
   • Reject malformed destinations.
   • Consider rejecting loopback, link-local, and private-network addresses unless explicitly required.
4. Maintain an allowlist of approved gateway hostnames in managed environments.
5. Display the effective endpoint and a clear warning that credentials and all request content will be shared with it.
6. Require interactive confirmation for unapproved endpoints where interactive execution is possible.
7. Prefer gateway-specific credentials with minimal permissions instead of reusing primary OpenAI credentials.
8. Document the trust implications of custom endpoints in SKILL.md.
9. Add automated tests confirming that HTTP and unapproved hosts are rejected.

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unbounded Dependency Version Prevents Reproducible and Controlled Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1
Vulnerability Type: Unbounded third-party dependency
Risk Level: Low

Complete Code Snippet

text

openai>=1.40.0

The documented installation command in SKILL.md:22-27 is:

bash

cd openai-deep-research-skill
python3 -m pip install -r scripts/requirements.txt

Technical Analysis

The dependency declaration specifies only a minimum version. Package installation may therefore resolve to any current or future openai release satisfying >=1.40.0. This makes installations non-reproducible and allows dependency behavior to change without any modification or review of this project.

A future defective or compromised compatible release could execute package code in the user's Python environment and subsequently receive the configured API credential when imported and instantiated by the script. No malicious package, typosquatted name, or unsafe third-party package index was identified in the audited files; the risk arises from the unrestricted update range.

Attack Path

1. A future release of the openai package satisfies the >=1.40.0 constraint.
2. The release contains a malicious supply-chain payload, security regression, or incompatible behavior.
3. A user follows the documented pip install -r scripts/requirements.txt command.
4. The package resolver selects the affected release automatically.
5. Package installation or runtime import executes the affected dependency code with the privileges of the user running the command.
6. At runtime, the dependency is also provided with the configured API key and handles all API request content.

Impact Assessment

The maximum impact depends on the behavior of the subsequently resolved package and the privileges of the installing or executing user. A compromised dependency could potentially access files and environment variables available to that user, capture the API key and research data, alter network reque ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, such as openai==<reviewed-version>.
2. Generate and commit a lock file containing exact transitive dependency versions.
3. Use hash-verified installation, such as pip requirements containing --hash entries.
4. Install only from an approved package index over HTTPS.
5. Review release notes and security advisories before updating the pinned version.
6. Use automated dependency scanning while requiring manual approval for production updates.
7. Test updates in an isolated environment before changing the lock file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises behavior that reads environment variables (OPENAI_API_KEY, optional OPENAI_BASE_URL) and writes multiple artifacts to disk, but it does not declare any explicit tool scope such as permissions or allowed tools. That mismatch weakens reviewability and policy enforcement: a user or orchestrator cannot easily tell from the manifest that the skill needs sensitive env access and filesystem write capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The runtime instructions say to set an API key and run real research jobs, including optional web search, but they do not warn users that prompts, research topics, and derived queries may be sent to external APIs and third-party web/search providers. In a deep-research workflow, topics can contain confidential business strategy, due-diligence questions, or other sensitive material, so omission of this disclosure creates a real data-exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI sets --language to zh-CN by default, which means the skill forces a specific locale unless the user explicitly overrides it. The policy for this audit flags language/locale constraints when they are imposed without opt-in or clear region-specific justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower-bound only constraint (openai>=1.40.0), which permits automatic installation of any newer release, including major-version changes or compromised upstream versions. This weakens supply-chain reproducibility and can introduce unexpected behavior or vulnerable package versions into an agent skill that performs high-trust external API interactions.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

openai>=1.40.0