deep-research

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 1:54 PM UTC
• Version: 0.2.5

Overview

This is a disclosed deep-research workflow skill that writes local audit artifacts and uses host-provided search, browsing, and optional sub-agents without evidence of hidden exfiltration or destructive behavior.

Install only in a workspace or user skill scope you intend to trust. During use, keep external operations read-only, avoid placing credentials in research materials, confirm what local files may be used as sources, and review generated research-run/ artifacts before relying on the report.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a high-level deep research workflow system for conducting and auditing research tasks. The supplied code instead implements a narrow validation script for run metadata and artifact path safety. Its primary purpose is integrity and path-containment checking of run_manifest.json and related artifacts, not research orchestration or evidence-based analysis. This is a material purpose mismatch, not merely an internal supporting detail, because the code chunk exposes functionality centered on manifest validation and filesystem safety that is unrelated to the declared end-user research behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a full deep-research workflow system for conducting and auditing research tasks. The supplied code chunk is much narrower: it only validates a local sources.jsonl file for formatting and status issues, duplicate canonical URLs/paths, and some evidence-quality warnings. It does not perform research, orchestrate tools, query sources, verify source content, disclose conflicts, or generate final reports/evidence packages. While source validation could be a supporting component of such a workflow, this chunk’s actual primary purpose is materially different from the declared end-user capability, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The supplied code chunk is only a shared helper module for validators. It reads local JSON/JSONL files, validates required fields and unique IDs, and writes JSON output. It does not implement the described deep research workflow, host-tool orchestration, iterative questioning, evidence gathering, source verification, or auditable report generation in any substantive sense. This is a materially different and much narrower purpose than the declared description, so it should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about a research workflow system for auditable industry/competitive/risk research using host tools, iterative questioning, source verification, and conflict disclosure. The supplied code does something materially different: it evaluates benchmark outputs against golden cases using local JSON/JSONL inputs and calculates scoring metrics. While there is a small overlap in the notion of conflict disclosure/privacy checking as evaluation dimensions, the code does not conduct research, orchestrate tools for investigation, retrieve or verify sources, or generate research reports. Its primary purpose is benchmark assessment, so the description does not accurately represent the code's behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full research workflow skill for competitor/industry/risk/document research, including iterative questioning, multi-source verification, and auditable deliverables. The supplied code does not perform research or orchestrate such a workflow. Instead, it validates a supplied runtime capability declaration and chooses a safe execution mode based on availability of operations like search, fetch, delegate, artifact I/O, and audit. It is explicitly offline and only checks JSON input; it does not search, fetch, read, delegate, generate reports, or compile evidence packages. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about orchestrating a deep research workflow and producing auditable research outputs. The actual code does not perform research orchestration, source verification, questioning, reporting, or evidence packaging. Instead, it recursively reads files from a run directory and detects secrets and PII using regexes, optionally failing when PII is found. That is a materially different primary purpose and an undeclared capability focused on sensitive-data scanning rather than research workflow execution. While such scanning could be a supporting safety check in a larger system, this code chunk itself is specifically dedicated to that separate function, so the description does not accurately represent what this code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a research-oriented workflow skill for conducting deep investigations and producing auditable research outputs. The supplied code does something entirely different: it validates the structure and metadata of a SKILL.md bundle and checks referenced files. There is no implementation of research orchestration, querying, evidence collection, source comparison, or report generation. This is a clear primary-purpose mismatch.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

Run from the skill root or a repository that contains the skill:

```bash
codex exec --ephemeral --sandbox read-only -C <workspace> \
  "Read SKILL.md and references/adapter-contract.md. Run python scripts/validate_skill.py . and report the exit status. Do not modify files."
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

For a real research run, use the existing native search tool only when the user permits external reads and the current Codex host exposes it:

```bash
codex exec --sandbox workspace-write -C <workspace> \
  "Load SKILL.md. Complete clarification before using web_search; write only research-run/ artifacts."
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# Claude Code Capability Profile

Claude Code can consume a repository `SKILL.md`/instruction bundle, use the tools enabled by the host, and run shell commands in a configured working directory. Run `python scripts/build_adapters.py --output dist`, then install `dist/claude-code/deep-research/`. The conventional project location is `.claude/skills/deep-research/SKILL.md`; user-level installs use `~/.claude/skills/deep-research/SKILL.md`. Exact discovery and sub-agent features vary by installation, so adapters must record observed behavior rather than assume a CLI version.

## Capability contract

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# Claude Code Capability Profile

Claude Code can consume a repository `SKILL.md`/instruction bundle, use the tools enabled by the host, and run shell commands in a configured working directory. Run `python scripts/build_adapters.py --output dist`, then install `dist/claude-code/deep-research/`. The conventional project location is `.claude/skills/deep-research/SKILL.md`; user-level installs use `~/.claude/skills/deep-research/SKILL.md`. Exact discovery and sub-agent features vary by installation, so adapters must record observed behavior rather than assume a CLI version.

## Capability contract

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# Claude Code Capability Profile

Claude Code can consume a repository `SKILL.md`/instruction bundle, use the tools enabled by the host, and run shell commands in a configured working directory. Run `python scripts/build_adapters.py --output dist`, then install `dist/claude-code/deep-research/`. The conventional project location is `.claude/skills/deep-research/SKILL.md`; user-level installs use `~/.claude/skills/deep-research/SKILL.md`. Exact discovery and sub-agent features vary by installation, so adapters must record observed behavior rather than assume a CLI version.

## Capability contract

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The instruction text is written as a mandatory operating directive in Chinese and does not offer any user language choice or opt-in. This creates a natural-language locale policy concern because the skill appears to enforce a specific language/locale implicitly rather than documenting flexibility or a justified region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The profile narrative is written in Chinese and does not indicate that language selection is optional or configurable. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.

Session Persistence

Medium

• Category: Rogue Agent

Content

若需要附属 references/scripts，推荐复制完整目录，或使用 Hermes 支持的 GitHub/URL 安装方式，确保 `SKILL.md` 相对路径下的文件一起存在：

```bash
mkdir -p ~/.hermes/skills/deep-research
cp -R dist/hermesagent/deep-research/. ~/.hermes/skills/deep-research/
hermes skills list
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The profile content is written as an instruction-oriented capability document entirely in Chinese, beginning with normative guidance on how the skill should behave. There is no indication that language choice is optional or tied to a documented region-specific requirement, which can violate language/locale policy when a skill implicitly forces a specific language.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains all substantive instructions in Chinese, which effectively forces a specific language on users and implementers. The policy allows locale constraints only when they are explicitly optional or clearly justified, neither of which is stated here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The operational contract text for all agent roles is written entirely in Chinese, which imposes a specific language on users or implementers without any stated choice, opt-in, or justification. This matches the policy category for language or locale constraints that are not optional or documented as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This markdown file uses only Chinese for the skill-facing documentation, which can impose a specific language on users without opt-in. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The document is written entirely in Chinese and does not indicate that language selection is optional or limited to a specific regional/compliance context. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

failed = 0
    for command in commands:
        print(f"\n$ {' '.join(command)}")
        completed = subprocess.run(command, cwd=run_dir.parent)
        failed += completed.returncode != 0
    print(f"\nGATES: {'PASS' if not failed else 'FAIL'} ({failed} failed)")
    return 0 if not failed else 1

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The natural-language content in this file is entirely in Chinese, which imposes a specific language on readers without any opt-in or explanation of a region-specific requirement. Under the stated policy, this is a locale/language constraint that should either be optional or explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The generated YAML template hard-codes Chinese placeholder text such as "待确认" for multiple fields. This imposes a specific language/locale in user-facing artifacts without any opt-in or documented justification, which matches the language-policy violation criteria.

Static analysis

No suspicious patterns detected.