Deep Research

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is generally aligned with deep research, but it tells the agent to install an additional unreviewed workflow skill with confirmation suppressed.

Before installing, verify the AnyGen CLI and the referenced anygen-workflow-generate skill from a trusted source. Install secondary skills manually rather than allowing an automatic '-y' install, and use a dedicated AnyGen API key for non-sensitive research unless you are comfortable with AnyGen's data handling.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A separate unreviewed skill could be added and influence future agent behavior before the user has inspected it.

Why it was flagged

This asks the agent to install an additional skill that is not part of the reviewed manifest, and '-y' suppresses confirmation for a change to the agent environment.

Skill content

If the `anygen-workflow-generate` skill is not available, install it first:

```bash
anygen skill install --platform <openclaw|claude-code> -y
```

Recommendation

Review and install the referenced workflow skill manually from a trusted source, declare it as a dependency, and avoid suppressing confirmation for skill installation.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone using the configured environment may be able to consume the user's AnyGen account quota or access provider features allowed by that key.

Why it was flagged

The skill requires an AnyGen API key or login session, which is expected for the provider but still grants access to the user's AnyGen account.

Skill content

anygen auth login --api-key sk-xxx

# Or set env var
export ANYGEN_API_KEY=sk-xxx

Recommendation

Use a dedicated, least-privilege API key if possible and revoke it if the skill is no longer needed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Sensitive research topics or business questions may be sent to AnyGen's service.

Why it was flagged

The artifact discloses that research tasks are processed by an external provider, so user prompts or research topics may leave the local agent environment.

Skill content

This skill uses the AnyGen CLI to generate in-depth research and analysis reports server-side at `www.anygen.io`.

Recommendation

Avoid submitting confidential material unless the provider's terms, retention, and access controls are acceptable.