Claw Deep Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.1

Overview

This research skill is mostly coherent, but it asks to use prior agent memory and write reports/cache files automatically, which deserves review before installation.

Review this skill before installing if your research topics may include private, business, legal, medical, or otherwise sensitive information. Use it only where you are comfortable with background sub-agents, local report files, temporary research caches, and possible reuse of prior agent memory; prefer an updated version that declares memory_search and asks before using memory or writing files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:298

Finding

Undeclared Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:298; related permission declaration at clawhub.json:10
Vulnerability Type: Undeclared persistent-memory access and least-privilege violation
Risk Level: Medium

Vulnerable Code

English rendering of the instruction at SKILL.md:298:

markdown

1. Use `memory_search` to search historical records related to the current topic.

The declared tool permissions at clawhub.json:10 are:

json

"tools": ["web_search", "web_fetch", "sessions_spawn"],

Technical Analysis

The Skill directs the Agent to query persistent historical memory through memory_search, but that capability is absent from the package's declared tool list. Searching prior conversations or stored research is not necessary to complete a fresh web-research request and therefore exceeds the minimum privileges represented by the metadata.

This creates a transparency and access-control mismatch: users or reviewers relying on clawhub.json would expect only web searching, web fetching, and sub-agent creation, while the runtime instructions additionally request access to cross-session state. Topic-based retrieval may return private context from earlier sessions and incorporate it into the current research process.

The reviewed instructions do not explicitly direct the Agent to transmit retrieved memory to an external service. Therefore, direct network exfiltration of historical memory is not established. The confirmed risk is unauthorized or unexpected retrieval and reuse of persistent information.

Attack Path

1. A user requests research on a topic that overlaps with information stored in Agent memory.
2. The Skill follows SKILL.md:298 and invokes memory_search.
3. The search retrieves historical records associated with that topic, despite memory_search not being declared in clawhub.json.
4. Retrieved content is introduced into the current ...[truncated 891 chars]

Remediation

View remediation

Remediation Suggestions

1. Add memory_search to the declared tool list in clawhub.json so package metadata accurately represents runtime capabilities.
2. Require explicit user consent before searching historical memory. A fresh research request should default to no memory access.
3. Provide a clearly documented option such as “continue previous research” that enables memory retrieval only when selected by the user.
4. Restrict searches to records created by this Skill rather than searching general Agent history.
5. Display the date and identity of any historical report before loading its contents.
6. Prevent retrieved historical content from being included in web-search queries unless the user separately approves that disclosure.
7. Mark historical material in the final report and avoid copying sensitive details not required for the current task.
8. Update both English and localized documentation to disclose memory access, cache-state writes, sub-agent delegation, and report storage behavior.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README advertises very broad natural-language triggers such as 'Do a deep dive on...' and 'I need a comprehensive analysis of...'. In agent systems that auto-dispatch skills from conversational cues, such generic phrases can cause unintended activation, especially in mixed contexts or prompt-injection scenarios where untrusted content includes those phrases. The skill’s autonomous multi-phase search and report generation make accidental invocation more consequential than a simple informational skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The implicit trigger examples are broad enough to match many ordinary user requests for analysis or reports, which can cause the skill to activate without explicit consent. In an agent environment, unexpected activation can change workflow, increase search/tool usage, and cause the agent to follow a more autonomous multi-step process than the user intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill introduces autonomous sub-agent spawning and background execution that are not reflected in the manifest description, meaning users may expect an interactive research workflow but instead trigger additional asynchronous agents and network activity. Hidden autonomy increases the chance of unexpected data propagation, harder-to-audit actions, and user confusion about what context is being sent where.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill allows automatic selection of background sub-agent execution when certain conditions are met, without a strong upfront warning that additional autonomous networked processing may occur asynchronously. This can lead to unanticipated data sharing, longer-lived tasks, and reduced user visibility into what actions the system is taking on their behalf.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs the agent to persist intermediate research state to a local cache file and later clean it up, but it does so automatically and without any explicit user consent or strong data-minimization guardrails. Because research topics may contain sensitive user queries or fetched content, writing them to disk expands the data exposure surface through leftover files, filesystem permissions, backups, or later access by other processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill specifies automatic local file creation for research cache data without a prior warning or consent step, which is dangerous because users may not realize their prompts, topics, and gathered content are being persisted outside the conversation. Lack of notice removes the user's ability to judge sensitivity, choose safer handling, or decline persistence altogether.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Persisting detailed research cards and later reusing them increases the chance that sensitive user inputs, proprietary topics, or fetched material remain accessible beyond the immediate task and may be surfaced in later outputs. Even if intended for convenience, persistence across sessions creates a real risk of unintended disclosure through stale files, broad filesystem access, or overbroad reuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delivery rules require saving full reports to persistent locations such as Desktop, workspace, or /tmp, which goes beyond a normal chat-only research assistant and can expose sensitive content to other local users, synced folders, backups, or insecure temporary directories. The fallback chain also broadens where data may land without confirming user intent or the sensitivity of the report.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The fallback behavior tells the agent to paste the full report into chat if file writing fails, which can disclose sensitive research results or user-supplied information in a less controlled channel than intended. This is especially risky in IM-style environments, shared chats, logged sessions, or channels with broader audience visibility than local file storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that full reports are saved to local files, including fallback locations like Desktop, workspace, or temp directories, without an explicit warning or opt-in. Writing agent-generated content to disk can create privacy, persistence, and data handling risks, particularly if research topics contain sensitive user information or if reports are written to shared or monitored locations. The danger is increased because the skill can run in background/sub-agent mode, making file creation less visible to the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill's stated purpose focuses on iterative web research and structured reporting, but the workflow also instructs automatic memory_search over prior topic history. Reusing historical memory may be helpful, yet it introduces cross-session data access not clearly disclosed in the manifest's purpose statement.

Content

No source excerpt is available for this finding.