Probe First Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:55 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent deep-research workflow, but it requests broader local command and file-editing authority than its research purpose needs and can persist research state without a clear user-facing consent step.

Review this skill before installing if your environment grants real Bash or broad file-editing powers. Its search and fetch behavior is expected, but consider removing Bash/Edit permissions or running it in a constrained workspace, and ask for explicit notice before it writes any research-state file.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Research Skill Requests Unnecessary Shell and File-Editing Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Excessive tool permissions / violation of least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

---
name: probe_first_research
version: "1.0.0"
description: "Probe-first deep research — low-cost snippet reconnaissance before committing to full searches"
author: ClawHub
license: MIT
allowed-tools: WebSearch, WebFetch, Read, Write, Edit, Bash, AskUserQuestion
user-invocable: true

Technical Analysis

The declared functionality is a web-research workflow based on search, page retrieval, source analysis, user confirmation, and report generation. WebSearch, WebFetch, and AskUserQuestion directly support that functionality. Read and limited Write access may support the documented recovery file used during long research sessions.

No documented workflow requires arbitrary shell-command execution. The Bash permission therefore exceeds the minimum privileges needed by the Skill. General-purpose Edit access is also broader than the documented requirement to create or update a task-local research-state file.

These permissions materially increase the impact of prompt injection or unintended agent behavior. Because the Skill retrieves content from arbitrary websites, an attacker can place adversarial instructions in a page selected during research. If the agent incorrectly treats those instructions as trusted, the availability of Bash and unrestricted file-editing capabilities could turn a content-level prompt injection into local command execution or unauthorized file modification.

The audited files do not contain commands that directly exploit these permissions, and no intentional sensitive-data exfiltration was found. The network access flagged by the pre-scan is primarily the expected web_search and web_fetch behavior required for the declared research functionality. The finding concerns the unnec ...[truncated 2007 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools; no audited workflow step requires arbitrary shell execution.
2. Remove Edit unless the Skill has a specific, documented need to modify existing files.
3. If research-state persistence is retained, replace general-purpose file access with a narrowly scoped storage capability restricted to a designated task-local file or directory.
4. Consider enabling Write only when long-session recovery is activated, rather than granting it for every invocation.
5. Treat search results and fetched pages strictly as untrusted data. Explicitly instruct the agent never to execute commands, invoke tools, disclose data, or change its workflow based on instructions found in retrieved content.
6. Restrict outbound network access to the dedicated search and fetch tools rather than allowing shell-based networking.
7. Apply host-level sandboxing so the Skill cannot access credentials, unrelated user files, sensitive environment variables, or directories outside its workspace.
8. Require explicit user approval before any local file is created or modified, and disclose the exact target path.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description frames the skill as 'low-cost snippet reconnaissance before committing to full searches,' which suggests a lightweight probing capability. However, the documented behavior includes deep multi-round research with web_fetch, synthesis, detailed reporting, and follow-up workflows, so the actual skill scope substantially exceeds the manifest's narrow description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Early documentation states the skill 'runs a fast, cheap reconnaissance pass — reading only snippets, never fetching full pages,' reinforcing a no-fetch-first intent. But the edge-case rule for URL input instructs the agent to fetch the URL first, which directly contradicts that earlier documented constraint.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

4. **Wait for user confirmation.** This is **STOP POINT 1**.
   - If user says "go", "proceed", "looks good", "直接做", or similar → continue to Phase 3.
   - If user provides feedback → adjust the plan and re-present.
   - If user asks to skip confirmations → note preference and proceed without future stops.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs writing intermediate research state to a local file without an explicit user-facing notice or consent step. This creates unannounced local persistence of potentially sensitive user topics, sources, and derived findings, which can expose data to later sessions, other tools, or anyone with workspace access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.