ClawHub
Back to skill

Security audit

Vibe Research

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only research skill may run broad web research after approval, but I found no hidden execution, credential access, persistence, or destructive behavior.

Install this only if you want an AI-led research workflow that can spend substantial time making web searches and fetching sources. Approve the plan carefully, avoid including secrets or sensitive proprietary details in topics that will be searched online, and treat the offline/no-cloud wording as inconsistent with the documented web_search and web_fetch workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Hidden Instructions

High
Category
Prompt Injection
Confidence
82% confidence
Finding

The file begins with a hidden Unicode character (likely a BOM/zero-width marker), which can obscure content boundaries and create parser inconsistencies across tools. While not harmful by itself in this context, hidden characters are risky because they can be used to conceal instructions, evade pattern matching, or cause security tooling and downstream processors to interpret the file differently.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md
# Academic Deep Research 馃敩

**Transparent, rigorous, self-contained research** 鈥?not a black-box API wrapper.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 1)May include surrounding context.

md
# Deep Research Example Workflow

## User Request
> "I need to understand the current state of AI coding assistants. What's the landscape, who are the players, and what should I know if I'm choosing one for my team?"

Hidden Instructions

High
Category
Prompt Injection
Confidence
89% confidence
Finding

The file begins with a hidden or non-printing character (likely a BOM or similar invisible Unicode marker), which can conceal content differences, interfere with parsing, or enable instruction smuggling patterns that are not obvious during review. In security-sensitive prompt assets, invisible characters reduce auditability and can mask malicious or confusing behavior even when the visible text appears benign.

Content

Scanner excerpt · quickref.md (reported line 1)May include surrounding context.

md
# Deep Research Quick Reference

## Invocation
- `/research` or mention "deep research" / "exhaustive analysis"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises broad trigger phrases such as "deep research on..." and "exhaustive analysis of..." that can cause the skill to be invoked unintentionally from ordinary user language rather than an explicit command. In an autonomous research skill, accidental invocation can lead to unnecessary browsing, data collection, and tool use, which increases operational and privacy risk even if the skill itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The top-level description defines the skill as AI-led research with autonomous literature review, hypothesis generation, analysis, and synthesis, but does not specify operational boundaries or safety constraints. That combination of autonomy plus vague scope can lead to the skill being invoked in contexts where unrestricted research orchestration is inappropriate, including sensitive domains where generated hypotheses or analyses may create harm.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'When to Use' section is broadly phrased around any research question or knowledge gap and says the agent 'takes ownership of the full research cycle,' which can cause the skill to activate for a wide range of generic requests without meaningful scoping. In an agentic setting, this increases the chance of unnecessary autonomous behavior, overreach into tasks needing tighter human approval, and misuse in higher-risk domains under the banner of 'research.'

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The workflow explicitly labels Phase 3 as 'Auto-Execute' and describes autonomous research cycles with tool use, analysis, and synthesis occurring without an explicit approval checkpoint. In an agent skill, this can lead to unreviewed external requests, excessive data collection, or actions that exceed the user's intended scope, especially when researching sensitive domains like healthcare and security.

Content

Scanner excerpt · example.md (reported line 76)May include surrounding context.

md
---

## Phase 3: Research Cycles (Auto-Execute)

### Theme 1: Market Landscape 鈥?Cycle 1

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation phrase includes natural-language triggers like "deep research" and especially "exhaustive analysis," which are broad enough to appear in ordinary conversation. This can cause unintended activation of the skill, unexpectedly shifting the agent into a more autonomous research workflow and increasing the chance of tool use or behavior changes without explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file requires "APA citations throughout," which is a natural-language instruction enforcing a specific formatting convention. Because the skill does not indicate that the user can choose a citation style or opt in to APA specifically, this is a language/locale-style policy constraint that may conflict with organizational preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.