Security audit

Deep Research Work From Xian.LaoJ

Security checks for vulnerabilities and agentic risk

Overview

This research skill is not malicious, but it needs review because its included JavaScript workflow can generate mock sources and placeholder findings while the package presents itself as real verified research.

Review before installing or using this as an automated research implementation. The markdown workflow is reasonable, but the shipped JavaScript should be treated as demo or scaffold code unless it is changed to perform real retrieval and provenance tracking. Avoid sensitive research topics if console logs or saved research files may be retained.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents this as a functional, comprehensive research system for thorough multi-source investigation. The actual code is primarily a mock prototype/workflow skeleton. Comments explicitly say that real implementations would call web_search and web_fetch tools, but no such calls exist. Most helper methods return canned values rather than analyzing real inputs. In addition, deepDive, synthesisAndValidation, and reportGeneration reference fields like researchPlan.phase1 and researchPlan.phase2, even though executeResearchPhases stores phase outputs in a separate findings object, so the workflow as written would not correctly pass results between phases. This is a material mismatch in actual behavior versus declared capability and purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file states that the skill uses web search/fetch, browser interactions, memory search, and write/edit operations, all of which can affect user privacy or modify local artifacts. The description provides no warning or disclosure about browsing external sites, accessing prior research context, or creating/editing report files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The class advertises a complete research workflow and returns structured findings and confidence, but the implementation is largely synthetic and uses generated mock sources, mock content, and fixed placeholder outputs. In a research skill context, this can mislead downstream users or agents into treating fabricated results as verified research, creating integrity and decision-making risks even though it is not a direct code-execution issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline comments state that the code would perform web search and content retrieval, but the actual behavior synthesizes data locally. This discrepancy is dangerous in a deep-research skill because operators may assume external validation occurred when no such validation happened, increasing the chance of fabricated or unsupported outputs being trusted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code logs the full user-supplied research topic to the console, which can expose sensitive or confidential subject matter in logs. While the operation is visible in code, there is no accompanying warning, confirmation, or comment indicating that user input will be recorded.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.