Security audit

deep-research

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its deep-research purpose, but it includes a loosely scoped local SDK override that can execute arbitrary JavaScript with the Gemini API key available.

Install only if you are comfortable giving the skill a Gemini API key and sending research prompts to Gemini. Avoid using GOOGLE_GENAI_SDK_PATH unless you fully trust the exact local SDK file, because that path is executed as JavaScript with the same environment as the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Ae1

High

Category: analysis-evasion
Content: 脚本与 `SKILL.md` 位于同一目录。执行时先把脚本路径解析为当前技能目录下的 `deep-research.mjs`，不要写死开发机绝对路径。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The dynamic import uses a caller-influenced path or specifier and resolves relative/local filesystem locations into executable module URLs. This creates an unnecessary arbitrary code execution primitive: an attacker controlling GOOGLE_GENAI_SDK_PATH can run attacker-supplied JavaScript before any API call, inheriting access to the process environment including GEMINI_API_KEY.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs use of an environment variable containing a sensitive API key and execution of a local Node.js script, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a trust and review gap: an orchestrator may invoke the skill without clear least-privilege boundaries, increasing the chance of unintended environment access or broader execution than reviewers expect.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases include generic requests like '研究一下', '写研究报告', and '详细分析', which can match many ordinary user prompts. Overly broad activation can cause this skill to run in situations the user did not intend, leading to unnecessary external research actions, API usage, and possible transmission of sensitive prompt context to the Gemini service.

Natural-Language Policy Violations

Medium

Confidence: 70% confidence
Finding: The natural-language content of the skill is entirely in Chinese and instructs usage in that locale, but it does not state that language choice is optional or user-selectable. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless clearly justified as region-specific.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script explicitly supports a GOOGLE_GENAI_SDK_PATH override, enabling loading of a local module outside the expected @google/genai package. Because Node executes module top-level code during import, anyone who can influence this environment variable can cause arbitrary code execution in the context of the skill, which is unrelated to the stated deep-research/report-generation purpose.

Static analysis

No suspicious patterns detected.