Deep Research Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 0.1.0

Overview

This is a legitimate deep-research skill, but it needs review because it performs broad autonomous web fetching and writes files with weak scoping.

Install only in a constrained environment with non-production API keys and no sensitive local or internal-network access. Avoid confidential research topics unless you are comfortable sending queries and content to external services, and review or change the fixed report paths before running the backend.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: backend/agent.py:45

Finding

Unrestricted Server-Side URL Fetching Enables SSRF

Content

View full analysis

str: """Fetch a webpage and convert HTML to markdown.""" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) " "Chrome/120.0.0.0 Safari/537.36" } try: resp = httpx.get(url, headers=headers, timeout=timeout, follow_redirects=True) resp.raise_for_status() return markdownify(resp.text) except Exception as e: return f"[Error fetching {url}] {e!s}" ``` The untrusted URL reaches the fetch function through: ```python for r in results.get("results", []): url = r["url"] title = r.get("title", url) content = fetch_webpage_content(url) texts.append(f"## {title}\n**URL:** {url}\n\n{content}\n---") ``` ### Technical Analysis The application fetches URLs returned by Tavily without validating the URL scheme, hostname, port, resolved IP address, or redirect destinations. The use of `follow_redirects=True` also permits an initially public URL to redirect to an internal destination. Because search results are external and potentially attacker-influenced, they cannot be treated as trusted destinations. A malicious or compromised indexed page could return or redirect to: - Loopback services such as `127.0.0.1` - Private-network addresses - Link-local and cloud metadata endpoints - Internal administrative services - IPv6 loopback, private, or mapped-address variants The fetched response is returned to the research agent, so internal response data can enter the LLM context and potentially be incorporated into the generated report. # ...[truncated 1269 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: backend/agent.py:78

Finding

Untrusted Web Content Can Indirectly Hijack Autonomous Agent Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: backend/requirements.txt:1

Finding

Open-Ended Dependency Versions Permit Unreviewed Supply-Chain Changes

Content

View full analysis

=0.1.0 langchain>=0.3.0 langchain-core>=0.3.0 langchain-anthropic>=0.3.0 tavily-python>=0.5.0 httpx>=0.27.0 markdownify>=0.13.0 ``` The documented installation command is: ```bash cd deep-research-agent/backend pip install -r requirements.txt python agent.py "Research topic here" ``` ### Technical Analysis Every dependency uses an open-ended lower bound. Consequently, separate installations can resolve to different versions, including future releases that were not available when the Skill was reviewed. No lockfile or package hashes are provided to authenticate the expected dependency artifacts. Python package installation may execute build backend code, and imported dependencies execute with the same operating-system privileges as the research agent. A compromised upstream release, malicious transitive dependency, or incompatible future version could therefore change installation-time or runtime behavior. The project metadata and requirements also describe dependencies differently, making the complete effective dependency set less transparent. ### Attack Path 1. An upstream package or one of its transitive dependencies is compromised, or a malicious future release is published. 2. A user runs `pip install -r requirements.txt`. 3. The resolver selects the new release because it satisfies the `>=` constraint. 4. Package build or installation logic executes in the user's environment, or malicious code executes when imported. 5. The compromised dependency gains the process's privileges and can access available files, environment variables, API keys, and network connectivity. ### Impact Assessment The potential impact is bounded by the account or container used for i ...[truncated 587 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises autonomous web search, full-page content extraction, sub-agent delegation, and persistent file writing, but it does not clearly warn users that prompts or derived data may be sent to third-party services and that the skill may modify local files. In an agent setting, this can lead to unintended disclosure of sensitive information and unexpected local state changes because users may trigger the skill without understanding its external network and filesystem effects.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises behaviors that rely on environment variables and networked web research, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates ambiguity about what capabilities the agent may invoke and weakens least-privilege controls, increasing the chance of unintended external access or secret exposure during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on generic requests like 'Research [X]' or comparison/analysis prompts that may not actually require this higher-risk skill. Overbroad activation can cause unnecessary network calls, delegation, and data handling in situations where a simpler tool would suffice, expanding exposure and making misuse more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The backend instructions describe autonomous web research, sub-agent spawning, and writing a final report file, but they do not clearly warn that prompts or derived data may be transmitted to third-party services or that local files will be created. In a research agent, this context makes the issue more significant because the workflow is explicitly designed for extensive external communication and persistent output, which can surprise users and leak sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The agent sends user-provided research queries to Tavily and then retrieves full third-party webpage contents over the network, which can expose sensitive prompts, internal topics, or regulated data to external services without any explicit disclosure or consent mechanism in this file. In a deep-research skill, this behavior is core functionality, but it still creates a real privacy and data-handling risk if users assume local-only processing or provide confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow instructs the agent to write to fixed paths like /research_request.md and /final_report.md without confirmation, which can cause unintended file creation or overwrite in the runtime environment. While this appears intended for report generation rather than malicious persistence, fixed absolute paths increase the risk of clobbering files, leaking sensitive prompts into predictable locations, or failing unsafely in privileged/containerized environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says, 'Just say: "帮我深度研究一下 [主题]"' as the invocation example, which implies a language-specific trigger. Because no alternative language option or opt-in is provided in the surrounding documentation, this may conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a deep-research agent that performs autonomous web interactions and orchestrates multiple libraries, this weakens supply-chain control and makes security posture non-reproducible.

Content

Scanner excerpt · backend/requirements.txt (reported line 1)May include surrounding context.

text

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

langchain is unpinned, which allows installation of any later version satisfying the constraint and makes it impossible to guarantee whether known vulnerable releases are excluded. Because this skill is an autonomous research agent using agent frameworks and prompt/tool orchestration, exposure in this dependency can materially increase risk from upstream code execution, prompt injection handling flaws, or unsafe deserialization bugs.

Content

Scanner excerpt · backend/requirements.txt (reported line 2)May include surrounding context.

text

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0

Unverifiable Dependency: langchain has 16 known advisory(ies) (CVE-2023-36258 (langchain arbitrary code execution vulnerability); CVE-2026-45134 (LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust); CVE-2024-2965 (Denial of service in langchain-community) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The manifest does not pin langchain, and the package family has multiple known advisories, so the actual installed version may be vulnerable without any visibility in this file. This is more concerning in an autonomous research agent because agent frameworks often sit on the trust boundary between model outputs, tools, remote content, and local execution logic.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

langchain-core is unpinned, so deployments may silently pick different versions with different security characteristics. Given the agent context and the library's central role in prompt processing, templating, I/O, and model/tool interactions, an affected upstream release could expose sensitive data, enable SSRF-like behavior, or introduce file access issues.

Content

Scanner excerpt · backend/requirements.txt (reported line 3)May include surrounding context.

text

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0

Unverifiable Dependency: langchain-core has 16 known advisory(ies) (CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2024-10940 (langchain-core allows unauthorized users to read arbitrary files from the host f); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

langchain-core has known advisories, but because no exact version is pinned, the deployment could resolve to an affected release and the risk cannot be verified from the manifest. The skill's autonomous, multi-step research behavior and likely processing of untrusted web/model inputs make core library flaws especially impactful.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

langchain-anthropic is only lower-bounded, so future vulnerable versions may be installed without review. In this agentic skill, provider integration libraries may process prompts, tool calls, and remote content, so version drift increases the attack surface and complicates incident response.

Content

Scanner excerpt · backend/requirements.txt (reported line 4)May include surrounding context.

text

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

Unverifiable Dependency: langchain-anthropic has 2 known advisory(ies) (CVE-2026-55443 (LangChain: Path traversal and sandbox escape in LangChain file-search middleware); CVE-2026-55443 (LangChain: Path traversal and sandbox escape in LangChain file-search middleware)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

langchain-anthropic has listed advisories, and the absence of version pinning means the manifest cannot demonstrate that a safe release will be installed. While the exact exploitability depends on how the integration is used, provider middleware flaws can become relevant in an agent that handles complex tool and content flows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

tavily-python is unpinned, creating non-reproducible builds and making it difficult to assess whether fetched versions contain security defects. Since this skill performs web search and likely handles untrusted internet content, uncontrolled dependency upgrades can increase exposure to parsing, request-handling, or data leakage issues.

Content

Scanner excerpt · backend/requirements.txt (reported line 5)May include surrounding context.

text

langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

httpx is unpinned, so the runtime may install varying versions over time, undermining reproducibility and potentially reintroducing known flaws. Because this package handles outbound HTTP for a web-enabled research agent, weaknesses in request validation or transport behavior could affect confidentiality, integrity, or availability.

Content

Scanner excerpt · backend/requirements.txt (reported line 6)May include surrounding context.

text

langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

httpx has known advisories, but the manifest's unpinned specification prevents verification that the installed release is patched. Since this skill performs network operations, even lower-severity HTTP client flaws can matter when interacting with untrusted external services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

markdownify is unpinned, which permits uncontrolled version drift and uncertain exposure to parser-related vulnerabilities. In a research workflow that may convert arbitrary remote HTML into markdown, parser bugs can become more relevant than in a non-content-processing application.

Content

Scanner excerpt · backend/requirements.txt (reported line 7)May include surrounding context.

text

langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

Unverifiable Dependency: markdownify has 2 known advisory(ies) (CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

markdownify has advisories and the unpinned requirement leaves the resolved version unverifiable, so a vulnerable parser may be introduced unintentionally. This matters more here because the skill likely converts arbitrary web content, increasing the chance of malformed input triggering parser or resource-exhaustion issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.