Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本与 `SKILL.md` 位于同一目录。执行时先把脚本路径解析为当前技能目录下的 `deep-research.mjs`，不要写死开发机绝对路径。
Security audit
deep-research
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its deep-research purpose, but it includes a loosely scoped local SDK override that can execute arbitrary JavaScript with the Gemini API key available.
Install only if you are comfortable giving the skill a Gemini API key and sending research prompts to Gemini. Avoid using GOOGLE_GENAI_SDK_PATH unless you fully trust the exact local SDK file, because that path is executed as JavaScript with the same environment as the skill.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The dynamic import uses a caller-influenced path or specifier and resolves relative/local filesystem locations into executable module URLs. This creates an unnecessary arbitrary code execution primitive: an attacker controlling GOOGLE_GENAI_SDK_PATH can run attacker-supplied JavaScript before any API call, inheriting access to the process environment including GEMINI_API_KEY.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs use of an environment variable containing a sensitive API key and execution of a local Node.js script, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a trust and review gap: an orchestrator may invoke the skill without clear least-privilege boundaries, increasing the chance of unintended environment access or broader execution than reviewers expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include generic requests like '研究一下', '写研究报告', and '详细分析', which can match many ordinary user prompts. Overly broad activation can cause this skill to run in situations the user did not intend, leading to unnecessary external research actions, API usage, and possible transmission of sensitive prompt context to the Gemini service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
The natural-language content of the skill is entirely in Chinese and instructs usage in that locale, but it does not state that language choice is optional or user-selectable. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless clearly justified as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script explicitly supports a GOOGLE_GENAI_SDK_PATH override, enabling loading of a local module outside the expected @google/genai package. Because Node executes module top-level code during import, anyone who can influence this environment variable can cause arbitrary code execution in the context of the skill, which is unrelated to the stated deep-research/report-generation purpose.
- Content