deep-research

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 3:09 AM UTC
• Version: 0.2.7

Overview

This is a disclosed research-workflow skill with local audit helpers and scoped artifact writing, not evidence of hidden or destructive behavior.

Install only if you are comfortable with a Chinese-language research workflow that may use the host's already-approved web, browsing, file-writing, and optional sub-agent capabilities. Keep sensitive material out of research-run artifacts unless needed, review generated reports before sharing, and verify host permissions still restrict writes to the intended workspace/run bundle.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full deep-research workflow for competitor/industry/risk/document research with iterative questioning, multi-source original verification, conflict disclosure, and report/evidence-package delivery. The supplied code does not implement that workflow. Instead, it is a narrowly scoped checker for already-generated artifacts in a run directory: it loads claims/sources/evidence JSONL files, verifies evidence references and minimum counts, checks independence requirements for high-impact claims, optionally ensures final_report.md contains claim identifiers, computes coverage, and returns an audit result. While this supports an auditable research pipeline, it is only a validation component, not the described end-to-end research skill. That is a material purpose mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full research workflow capability that conducts deep investigation, asks follow-up questions, verifies sources, discloses conflicts, and produces reports/evidence. The actual code chunk does not perform research, search, analysis, report generation, or evidence collection. Instead, it audits whether expected workflow files and clarification steps exist and conform to rules. This is a materially different primary purpose: validator/compliance checker versus research executor. While the checks relate to the described workflow, they are only support tooling and do not match the declared end-user capability of conducting research.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a comprehensive research/audit workflow capability, but the supplied code only implements manifest validation for run metadata and artifact path safety. Its primary purpose is filesystem/JSON validation, not conducting research, querying sources, producing reports, or orchestrating iterative investigation. There is no evidence of model/search integration, host tool reuse for research, evidence packaging, or any of the described end-user workflow behaviors. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a comprehensive research workflow skill, but the supplied code chunk is a narrowly scoped validator for source metadata files. It loads local JSONL records, canonicalizes URLs/paths, detects duplicates, validates retrieval_status values, warns about weak evidence types, and writes a result. It explicitly avoids network requests by default and contains no logic for iterative questioning, source retrieval, conflict analysis, reporting, or orchestration of authorized host tools. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full-featured research workflow capability, but the supplied code chunk is only a shared helper module for validators. It reads JSON/JSONL files, checks required fields and duplicate IDs, and writes JSON output. Those are narrow support utilities, not the primary behavior described. While helper code can be part of a larger research system, this chunk by itself does not substantiate the declared end-user functionality, so the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a research workflow skill focused on conducting deep investigations with iterative questioning, multi-source verification, and producing auditable research reports. The supplied code does none of that. Instead, it is a deterministic benchmark evaluator for preexisting JSON/JSONL records. Its primary purpose is materially different: scoring benchmark outputs against golden cases. It also introduces undeclared behavior such as command-line execution, reading benchmark files from disk, computing evaluation metrics, and returning pass/fail status. There is no evidence of research orchestration, host-tool reuse for information gathering, multi-round questioning, source retrieval, or report/evidence package generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description promises a full research workflow capability: deep investigation, repeated follow-up questioning, source verification, conflict disclosure, and auditable outputs while reusing authorized host tools. The supplied code only initializes a filesystem bundle for a future research run. It writes template YAML/JSONL/Markdown files and a manifest, and records the initial question. This is a materially narrower and different primary purpose than the declared skill behavior. While the code is consistent with the narrow claim that it does not invoke a model or search tool, it lacks the core operational capabilities described, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement a research workflow at all. Instead, it validates a runtime capability declaration for safety/completeness, checks required capabilities like load_skill and artifact_io, enforces constraints such as read-only search and append-only artifact I/O, computes degraded fallback modes, and writes a validation result. This is a materially different primary purpose from the declared OpenClaw deep research skill. While the validator references research-related capabilities, it does not actually perform search, source verification, reporting, or iterative investigation. Therefore the description does not accurately represent the code chunk's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a research workflow skill focused on investigation, verification, and report generation. The supplied code does not implement research orchestration, source verification, host-tool reuse, or report/evidence synthesis. Instead, it performs a security/privacy scan over files in a directory, looking for API keys, bearer tokens, private keys, email addresses, and phone numbers. This is a materially different primary purpose and introduces undeclared capabilities around filesystem scanning and sensitive-data detection. While such scanning could be a supporting utility in a larger research pipeline, this code chunk itself is unrelated enough to the declared purpose that it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents the skill as an end-to-end deep research workflow for competitive/industry/risk/document research, including iterative follow-up, source verification, conflict disclosure, and report delivery. The supplied code chunk instead implements a validator for outputs of such a workflow. It inspects local files in a run directory, enforces required fields and allowed status values, checks cross-references among sources/evidence/claims/conflicts, and optionally verifies the existence/traceability of a final report. This is materially different from actually conducting research or orchestrating host tools, so the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a research-oriented workflow skill that conducts iterative investigation and produces auditable research outputs. The supplied code does something entirely different: it is a static validator/linter for a portable SKILL.md bundle. It performs file parsing and integrity checks on local bundle contents and does not implement any research workflow, host-tool orchestration, questioning, source gathering, verification, or report generation. This is a material purpose mismatch, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The profile content is written as operational instruction in Chinese, and the file does not indicate that language selection is optional or user-configurable. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file contains all substantive instructions in Chinese and does not indicate that language selection is optional or constrained by a documented regional requirement. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill contract content from L03 onward is written entirely in Chinese, which imposes a specific language on users or integrators without any stated option to choose another language. Under the policy, language-specific requirements are only acceptable when the file offers opt-in or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file presents all user-facing guidance exclusively in Chinese, and there is no statement offering alternative language support or indicating that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file presents all operational instructions in Chinese and does not indicate that users may choose another language. This can violate a language/locale policy when a skill effectively forces one language without explicit user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_gates.py (reported line 31)May include surrounding context.

python

failed = 0
    for command in commands:
        print(f"\n$ {' '.join(command)}")
        completed = subprocess.run(command, cwd=run_dir.parent)
        failed += completed.returncode != 0
    print(f"\nGATES: {'PASS' if not failed else 'FAIL'} ({failed} failed)")
    return 0 if not failed else 1

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language content in this file is written entirely in Chinese, which imposes a specific language on readers without any stated opt-in, alternative language, or documented region-specific justification. The applicable policy calls out language or locale constraints as violations when they are forced without user choice.

Content

No source excerpt is available for this finding.