Deep Research Agent

• Outcome: Pass
• Latest audit: May 28, 2026 · 5:56 AM UTC
• Version: 0.1.0

Overview

This is a coherent deep-research skill that uses expected web search, LLM provider keys, sub-agents, and report writing, but users should understand the privacy, file-output, and dependency-management caveats.

Install only if you are comfortable sending research topics, URLs, and fetched page content to Tavily and your chosen LLM provider. Run the backend in a dedicated virtual environment or sandbox, monitor API usage and cost, and check generated /research_request.md and /final_report.md outputs for sensitive content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs use of environment variables for API keys and web/network-backed tooling, but it does not declare corresponding permissions. That mismatch can bypass expected review or consent mechanisms, making secret access and outbound requests less transparent to the host system and user. In a research agent that performs autonomous multi-step search, this increases risk because network and credential use are central to operation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly describes persistent file writing (e.g. read/write_file and /final_report.md output) but does not warn users that invoking the skill may modify local files. In an autonomous agent context, undocumented filesystem writes can surprise users, overwrite existing data, or create sensitive artifacts on disk, especially when sub-agents operate automatically.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README advertises deep web research, Tavily-powered search, and multiple LLM backends, which implies that user prompts and fetched web content are sent to third-party services, but it does not disclose this data flow or associated privacy risks. For a research agent handling arbitrary user topics, omission of this warning can cause users to unintentionally transmit sensitive queries, proprietary text, or personal data to external providers.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are broad enough to match ordinary user requests such as generic 'research [X]' or comprehensive analysis prompts, which can cause the agent to invoke a powerful autonomous workflow unexpectedly. Because this skill performs multi-step web access and potentially delegated research, accidental triggering can lead to unnecessary external calls, cost, and execution of a more capable workflow than the user intended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The markdown describes running a backend script that writes a report file to `/final_report.md`, but it does not clearly warn the user about local file creation or where outputs will be stored. Hidden or poorly disclosed file-writing behavior reduces user awareness and can cause unintended persistence of sensitive research topics or collected data on disk. In an autonomous research context, this is more concerning because generated reports may contain proprietary or sensitive information aggregated from multiple sources.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The function fetches arbitrary URLs returned from search and converts full page contents to markdown, which are then supplied to the research workflow and potentially onward to an external LLM. In a deep-research agent, this creates a real data-sharing and prompt-injection exposure surface because untrusted remote content is ingested and processed without any user-facing consent, content isolation, or filtering.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The system prompt instructs the agent to write files to fixed paths such as /research_request.md and /final_report.md without clear prior disclosure or path controls. In an autonomous agent context, silent filesystem modification is risky because users may not expect writes, the fixed absolute-style paths can overwrite existing files in some runtimes, and prompt-injected workflows may abuse file-writing behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0

• Confidence: 90% confidence
• Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed. In a security-sensitive research agent that performs web access and multi-step orchestration, this increases supply-chain risk and can unexpectedly pull in vulnerable or behavior-changing releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0

• Confidence: 96% confidence
• Finding: Using an unpinned langchain version allows installation of arbitrary newer releases, which is especially risky because this package family has a history of serious advisories. Given this skill's autonomous research and delegation behavior, dependency drift could expose prompt injection, deserialization, or code-execution paths introduced in later versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0

• Confidence: 96% confidence
• Finding: An unpinned langchain-core dependency is risky because it permits unnoticed upgrades in a library central to agent execution, prompt handling, and integrations. In this context, where the agent processes external web content, that raises the chance of introducing exploitable SSRF, template injection, or file disclosure issues through dependency drift.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

deepagents>=0.1.0
langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

• Confidence: 88% confidence
• Finding: The unpinned langchain-anthropic dependency can resolve to later versions that change security-relevant behavior without review. Because this skill relies on model-provider integration during autonomous workflows, unexpected upgrades could alter request handling, data exposure boundaries, or inherited vulnerabilities from the broader stack.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.3.0
langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

• Confidence: 83% confidence
• Finding: An unpinned tavily-python dependency creates supply-chain and reproducibility risk by allowing unreviewed versions to be installed. Since this package is used for web search in an autonomous research agent, a compromised or breaking upstream release could directly influence external data retrieval and agent behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain-core>=0.3.0
langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

• Confidence: 93% confidence
• Finding: Leaving httpx unpinned means network-facing behavior may change with future releases, including the introduction of regressions or exploitable bugs. Because this agent performs HTTP requests against external resources, dependency drift in a core HTTP client materially increases attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain-anthropic>=0.3.0
tavily-python>=0.5.0
httpx>=0.27.0
markdownify>=0.13.0

• Confidence: 80% confidence
• Finding: The markdownify package is also unpinned, so future unreviewed versions may be installed. While the direct impact is typically lower than core agent or network libraries, this package processes potentially untrusted content and could still introduce denial-of-service or parsing issues.

Known Vulnerable Dependency: langchain — 10 advisory(ies): CVE-2023-36258 (langchain arbitrary code execution vulnerability); CVE-2026-45134 (LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust); CVE-2024-2965 (Denial of service in langchain-community) +7 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The file permits installation of langchain versions associated with multiple severe advisories, including arbitrary code execution and related unsafe deserialization or prompt-handling issues. In an autonomous deep-research skill that ingests external web content and coordinates sub-agents, exploitation risk is elevated because untrusted data is a normal operating input.

Known Vulnerable Dependency: langchain-core — 10 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2024-10940 (langchain-core allows unauthorized users to read arbitrary files from the host f); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: langchain-core is flagged with advisories covering SSRF, arbitrary file read, and template injection classes of issues, all of which are highly relevant to an agent that fetches and processes external content. Because langchain-core underpins prompt construction and model/tool orchestration, compromise here can directly affect confidentiality and execution safety.

Known Vulnerable Dependency: httpx — 2 advisory(ies): CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)

Critical

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: httpx is a network-facing dependency with known input-validation issues, and this skill explicitly performs web research over HTTP. Even if exploitability depends on exact runtime code paths and versions, allowing a vulnerable HTTP client in an autonomous external-fetching agent increases the chance of request smuggling, validation bypass, or related network abuse.

Known Vulnerable Dependency: markdownify — 1 advisory(ies): CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: markdownify has a reported denial-of-service style issue involving malformed large headline prefixes, and this skill may transform untrusted web content into markdown. That makes the advisory relevant, though the likely impact is availability degradation rather than direct code execution or data compromise.

Static analysis

No suspicious patterns detected.