Security audit

research-pro

Security checks for vulnerabilities and agentic risk

Overview

This is a real research skill, but it grants and reuses credentials, modifies multiple agent environments, performs external calls, and keeps research traces in ways users should review before installing.

Review this before installing in a sensitive workspace. Use a dedicated low-privilege API key, disable host credential reuse with RESEARCH_PRO_TRUST_HOST_ENV=0, turn tracing off for confidential topics with RESEARCH_PRO_TRACE=off, avoid REDDIT_SESSION/TOKEN_V2 cookies, and do not run the one-shot setup or run-with-creds wrapper on commands you have not explicitly chosen.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (58)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no permissions while instructing use of shell execution, file reads, and environment-backed credential access. This creates a transparency and policy-enforcement gap: a host may treat the skill as low-privilege even though its workflow clearly depends on higher-risk capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The public description frames the skill as a research assistant, but the body also defines installation/setup flows, credential bootstrapping, persistent trace capture, host-native bridge logic, and undeclared Reddit-specific access paths. Hidden or under-described behaviors reduce informed consent and can cause users or orchestrators to permit broader data access and external transmission than expected.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The setup prompt instructs the agent to perform a live external search test immediately after installation, but the skill metadata explicitly requires READY checks, a Search Target Confirmation Gate, and explicit user confirmation before any interactive external research. Embedding a search command in installation steps bypasses the documented consent boundary and can cause unapproved network activity or data disclosure during setup.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file instructs the agent to perform a global npm installation and later execute additional shell-level setup steps, which are system-modifying actions outside the core purpose of a research skill. In this context, normalizing package installation as something the agent should 'just execute' expands the skill's authority and increases the chance of unintended host changes or supply-chain exposure.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: These instructions direct the agent to solicit, receive, and apply a user's API key, giving a research skill direct credential-handling behavior that is broader than necessary for its purpose. Handling secrets in chat and shell commands raises the risk of accidental logging, disclosure, reuse, or misuse of the credential.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The guidance recommends modifying persistent shell profile files to retain PATH changes and API key configuration, creating durable changes unrelated to the research workflow itself. Persistent credential or environment changes increase the blast radius of compromise and may leave secrets accessible to future sessions, tools, or local users.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements a generic standalone chat client to xAI rather than a gated research-only workflow. That bypasses the skill’s documented READY/confirmation controls and enables arbitrary external prompting, making it easier to exfiltrate sensitive user content or perform unintended networked actions under the guise of the research skill.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script supports image attachments by converting local files into data URLs and sending them to the external API, but image upload is not justified by the stated research skill behavior. This expands the attack surface and creates an unnecessary path for transmitting sensitive local content outside the environment.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The header comments describe a generic Grok chat tool, which conflicts with the skill’s documented research-specific constraints and gating requirements. That mismatch is dangerous because operators and downstream tooling may trust the skill metadata while the implementation silently permits broader behavior.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The resolver is explicitly designed to read credential material from unrelated host application stores such as ~/.hermes/.env and ~/.openclaw/openclaw.json, then import matching secrets into research-pro. Even though it allowlists specific keys, this still crosses trust boundaries and can silently repurpose credentials that were provisioned for other tools, which increases the risk of unauthorized credential use and surprising data flow.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This script resolves an arbitrary named secret and writes the raw value directly to stdout. In agent workflows, stdout is commonly captured in logs, transcripts, tool outputs, CI logs, or chat history, so invoking this helper can leak credentials outside their intended trust boundary. The research skill context makes this more dangerous because the skill is designed for interactive agent use and external-search setup, where secrets such as API keys are likely present and command outputs may be exposed to users or persisted.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The module persistently records research questions, sub-questions, top URLs, and can associate them with a reusable run directory under the user's home directory. In a research skill, queries often contain sensitive business plans, investigative topics, or proprietary prompts, so this creates a side-channel retention mechanism beyond the core function of answering the user's request.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The CLI reads Reddit authentication cookies from environment variables and sends them on every request, even though all implemented endpoints are public reddit.com JSON endpoints that do not require authentication. This creates unnecessary exposure of sensitive session material to a helper script and increases the chance of credential leakage through process environments, logs, shell history, debugging, or reuse in broader agent workflows.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The help text advertises the tool as 'using cookies' and includes a cookie check workflow despite the code only calling public Reddit JSON endpoints. In a research skill context, this can socially normalize supplying live Reddit session cookies to an unnecessary helper, encouraging dangerous secret handling and making accidental credential disclosure more likely.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This wrapper hydrates credentials into process.env and then executes an arbitrary user-supplied command with those secrets inherited. Even if intended as a convenience shim, it expands the trust boundary from specific research tools to any executable available on the host, enabling credential exfiltration or misuse if an attacker can influence the command or arguments.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The self-test invokes chat, models, and direct grok-search behaviors that bypass the skill’s declared READY/Search Contract gating model. Even though this is framed as testing, it normalizes and preserves code paths for external-capability use outside the manifested workflow, which can undermine safety assumptions and operational controls if run in CI, setup, or troubleshooting contexts.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README states that the skill auto-triggers on broad keywords like 'research', 'investigate', and '调研', which can overlap with ordinary requests and cause the agent to enter a higher-privilege workflow than the user intended. In the context of a skill that performs external searches, logs traces, and can drive setup flows, accidental triggering increases the chance of unnecessary data exposure, unintended network access, or prompt-scope expansion.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup instructions direct users to write an API key into a plaintext file on disk, but do not prominently warn about credential sensitivity, rotation, shell-history leakage, or the risks of leaving secrets in temporary/shared environments. Although the file permissions are restricted, storing long-lived credentials this way can still lead to accidental disclosure via backups, sync tools, screenshots, copied commands, or misuse by other local processes running as the same user.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: These instructions direct the agent to clone code, execute a shell installer, create configuration files, and store an API key, yet they do not clearly warn the user that local system state will be modified and credentials will be written to disk. This increases the chance of users authorizing risky actions without informed consent, especially in agent environments that may execute setup steps with little friction.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The description states that the installer may create symlinks across multiple agent skill directories, which can modify several tool environments beyond the one the user expects. Without a clear warning and scoped consent, this broadens the blast radius of installation and can unintentionally affect other agents or workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions encourage executing global installation commands without clear user warning or consent about host-level changes. Even if the package is legitimate, silent installation changes the environment, may require elevated permissions, and exposes the user to package integrity and dependency risks.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Storing an API key in an environment variable and especially advising users to place it in a shell profile creates long-lived credential persistence without communicating the exposure risks. Persisted secrets may be read by other processes, inherited by subprocesses, exposed in diagnostics, or left behind after the task completes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: These examples instruct the agent to perform live web search, extraction, crawling, and site exploration, but they do not warn that user prompts, URLs, and retrieved content will be transmitted to Tavily or other external services. In a research-oriented skill, this increases the risk of inadvertent disclosure of sensitive user data during normal use, especially because the skill is explicitly designed to trigger multi-source external research.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document broadly promotes Tavily-powered search, extract, crawl, and research integrations without a general disclosure that using these tools causes external network access and may send user-supplied queries or target content to third-party infrastructure. Given the skill’s purpose as a systematic research assistant, omission of this warning makes unsafe data egress more likely during routine operation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script sends user prompts and any attached images to an external xAI endpoint without any explicit user-facing disclosure at send time. In a skill that promises gated external research behavior, silent transmission increases privacy and compliance risk, especially if users assume content is processed locally or only after confirmation.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-with-creds.mjs:35

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/selftest.mjs:18

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/research.mjs:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/tavily/integrations.md:548