T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:431- Finding
Unnecessary Access to Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Academic Deep Research
Security checks for vulnerabilities and agentic risk
Overview
This research skill is mostly coherent, but it asks to use prior persistent memory and network research in ways that are not clearly scoped or accurately disclosed.
Review before installing if you handle confidential, regulated, or proprietary topics. Use it only when you are comfortable with the agent searching the web and fetching pages for your topic, and avoid allowing persistent memory access unless you have confirmed the memory scope is limited to appropriate prior work.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:14- Finding
Mandatory Network Research Lacks Privacy Controls and Contradicts the Offline Claim
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README encourages invocation via very generic phrases such as asking for "deep research on..." or "exhaustive analysis of...", which can overlap with ordinary user language rather than a clearly scoped command namespace. In agent platforms, overly broad invocation patterns can cause accidental triggering, unintended routing, or prompt shadowing by hijacking requests that were not meant for this skill, especially because this skill is designed to take over a multi-step research workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger guidance is broad enough to match many ordinary requests such as 'tell me everything about X' or generic requests for analysis, which can cause the skill to activate outside clearly intended research scenarios. In practice this can override user expectations, increase unnecessary tool use, and expand exposure to prompt-driven web activity or parallel sub-agent execution without sufficiently narrow scoping.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The workflow explicitly labels Phase 3 as 'Auto-Execute' and then proceeds to issue tool actions without an intervening user approval step. In an agent skill, this creates autonomous external action behavior that can trigger broad web searches and fetches based on prior context, reducing human oversight and increasing the chance of unintended data exposure, excessive resource use, or unsafe research execution in sensitive domains like healthcare.
- Content
md --- ## Phase 3: Research Cycles (Auto-Execute) ### Theme 1: Market Landscape — Cycle 1
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation guidance is overly broad because it allows activation via a generic phrase such as "deep research" / "exhaustive analysis," which can match ordinary user conversation rather than an explicit command. In an agentic skill that performs multi-phase autonomous web research, ambiguous triggering increases the risk of unintended activation, unnecessary tool use, and execution of a heavyweight workflow without clear user intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The description requires "APA 7th citations," and later sections reinforce that this format must be used. This imposes a specific writing convention by default without offering user opt-in or documenting that the skill is limited to contexts where APA is required.
- Content
Static analysis
No suspicious patterns detected.