ClawHub
Back to skill

Security audit

Deep Search-mpro

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed research/report generator, but it needs Review because some included guidance tells agents or users to load and run unverified local skills and scripts outside the package.

Install only if you are comfortable with a research skill that may guide the agent toward web searches, report-file generation, and optional local scripts. Before using the AI tool learning-guide or format-conversion paths, verify any referenced sibling skills yourself, avoid following hard-coded /Users or ~/.workbuddy script paths blindly, and use a virtual environment with pinned dependencies for the optional Python scripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:63
Finding

Unpinned Third-Party Dependencies and Unverified Delegated Skill Execution

Content
View full analysis

Vulnerability Details

File Locations:

  • README.md:63
  • scripts/README.md:59,69
  • scripts/data_collector.py:20-24
  • references/technical/integration-guide.md:17-26
  • references/technical/integration-guide.md:177-184
  • references/technical/integration-guide.md:528

Vulnerability Type: Supply-chain exposure through unpinned packages and unverified external Skill scripts
Risk Level: Medium

Vulnerable Code

From README.md:63:

bash
pip install requests beautifulsoup4 lxml

From scripts/README.md:59,69:

markdown
- Requires dependencies: `pip install requests beautifulsoup4`
bash
pip install requests beautifulsoup4 lxml

From scripts/data_collector.py:20-24:

python
try:
    import requests
    from bs4 import BeautifulSoup
except ImportError:
    print("Please install dependencies: pip install requests beautifulsoup4")
    exit(1)

From references/technical/integration-guide.md:17-26:

bash
# Assumed deep-research-pro script path
cd ~/.workbuddy/skills/deep-research-pro/scripts

# Execute deep research
python research.py \
    --topic "China skincare market size 2024" \
    --max-sources 10 \
    --output /tmp/deep_research_result.json

# Or use its search capability; adjust for the actual local script
bash search.sh "skincare market size China growth rate" --max 8

From references/technical/integration-guide.md:177-184:

bash
cd ~/.workbuddy/skills/insights-hotspot/scripts

# Generate a hotspot insight report
python insights_generator.py \
    --directions 1,2,3,4 \
    --days 2 \
    --top 10 \
    --formats html,markdown,word \
    --search-results search_results.json

From references/technical/integration-guide.md:528:

bash
pip install --upgrade python-docx python-pptx

Technical Analysis

The documented package-installation commands do not pin dependency versions, verify package hashes, use a lock file, or constrain installation to a reviewed package index. Consequ ...[truncated 2447 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed version, for example through a version-controlled requirements file.
  2. Generate and enforce hashes using a hash-locked dependency workflow, such as:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Use a dedicated virtual environment rather than installing into the host or user-wide Python environment:
    bash
    python -m venv .venv
. .venv/bin/activate
  4. Record transitive dependencies in a lock file and update them through a controlled review process.
  5. Configure a trusted package index explicitly and avoid unreviewed extra indexes that may enable dependency confusion.
  6. Replace generic upgrade commands with installation from reviewed, pinned dependency manifests.
  7. Require sibling Skills to be obtained from an approved source and pinned to a specific version or commit.
  8. Verify checksums or signatures for sibling Skill packages before executing their scripts.
  9. Review delegated scripts and their dependency manifests before use; do not treat the existence of a directory under ~/.workbuddy/skills as proof of trust.
  10. Document that delegated scripts execute with the current user’s privileges and should be run in a sandbox or restricted environment when their provenance cannot be established.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (103)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using direct external HTTP requests to search engines instead of the built-in web_search/web_fetch tools bypasses expected agent controls, logging, and safety constraints. Combined with the mismatch between promised report generation and actual JSON-oriented data collection, this creates both governance risk and a higher chance of unsanctioned data egress or inconsistent security review outcomes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Using direct external HTTP requests to search engines instead of the built-in web_search/web_fetch tools bypasses expected agent controls, logging, and safety constraints. Combined with the mismatch between promised report generation and actual JSON-oriented data collection, this creates both governance risk and a higher chance of unsanctioned data egress or inconsistent security review outcomes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Using direct external HTTP requests to search engines instead of the built-in web_search/web_fetch tools bypasses expected agent controls, logging, and safety constraints. Combined with the mismatch between promised report generation and actual JSON-oriented data collection, this creates both governance risk and a higher chance of unsanctioned data egress or inconsistent security review outcomes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Using direct external HTTP requests to search engines instead of the built-in web_search/web_fetch tools bypasses expected agent controls, logging, and safety constraints. Combined with the mismatch between promised report generation and actual JSON-oriented data collection, this creates both governance risk and a higher chance of unsanctioned data egress or inconsistent security review outcomes.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/templates/target-users-template.html (reported line 1)May include surrounding context.

html
<!--
  目标用户分析模板 (Target Users Analysis Template)
  用于展示产品/服务的目标用户画像分析

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/templates/target-users-template.html (reported line 1)May include surrounding context.

html
<!--
  目标用户分析模板 (Target Users Analysis Template)
  用于展示产品/服务的目标用户画像分析

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/yonyou-network-competitive-analysis-20260318.html (reported line 359)May include surrounding context.

html
</head>
<body>
    <div class="container">
        <!-- 左侧导航 -->
        <nav class="sidebar">
            <div class="sidebar-header">
                <div class="sidebar-title">用友网络竞争分析</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/yonyou-network-competitive-analysis-20260318.html (reported line 403)May include surrounding context.

html
<!-- 右侧内容区 -->
        <main class="main-content">
            <div class="content-wrapper">
                <!-- 报告头部 -->
                <div class="report-header">
                    <h1 class="report-title">用友网络竞争分析</h1>
                    <div class="report-meta">

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file is written as a prescriptive skill guide entirely in Chinese, beginning with a Chinese-only title and providing no indication that language choice is optional or user-driven. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
74% confidence
Finding

The skill declares broad operational behavior around searching, reading references, and generating report files, but it does not define an explicit tool scope such as allowed-tools or permissions. In an agent environment, missing scope boundaries can allow the runtime or downstream implementation to access file, network, or shell capabilities more broadly than users would expect, increasing the blast radius if the skill is later extended or paired with hidden code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configuration sets output_locale = zh_CN, which establishes a specific language/locale preference in natural-language behavior. Under the policy, forcing a specific locale without explicit user choice or opt-in is a violation, and the nearby comment # zh/en does not clearly state that the user will be offered a choice at runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown template mixes English headings with core content fields, checklist items, and placeholders written in Chinese throughout, effectively constraining users to a specific language/locale. The file does not state that Chinese is optional, nor does it offer an alternative language or user opt-in, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example uses toLocaleDateString('zh-CN'), which forces Chinese locale formatting. The file does not state that this locale is optional, user-selected, or required for a region-specific use case, so it appears to impose a specific locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The HTML template explicitly sets the page language to zh-CN and uses Chinese-only report labeling in the title and visible UI text. This imposes a specific language/locale by default, and the file does not offer opt-in, selection, or a documented region-specific reason for the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template's instructional comments are written in Chinese and the visible UI labels are primarily Chinese, which imposes a specific language/locale by default. There is no indication that this template is intended only for a Chinese-speaking context or that users can opt into another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This HTML template’s instructional text and primary labels are written in Chinese, which imposes a specific language on users without indicating opt-in, alternatives, or a documented region-specific constraint. The policy explicitly flags language/locale restrictions when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language content in comments and visible headings is predominantly in Chinese, with no indication that users can choose another language or that the template is intended only for a Chinese-language context. This can violate a language/locale policy when a skill enforces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Allowing a bare tool name alone to trigger the skill is overly broad and can cause accidental activation on ambiguous user input. That increases the chance the agent executes an unintended workflow, performs unnecessary searches, or generates files when the user did not actually request a learning guide.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The open-ended trigger patterns lack clear negative boundaries and disambiguation rules, making it easy for unrelated queries to be routed into this skill. In an agent setting, broad routing increases unintended capability use and may bypass more appropriate skills or user confirmation steps.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document instructs the agent to load another skill from a hard-coded absolute local path, which expands behavior beyond the declared web-research workflow and assumes access to host-local files. This creates a path-traversal/unauthorized local resource access risk because the agent may be induced to read environment-specific files that were not part of the user-requested task or approved skill boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction to search and organize "5 项中文学习资源" imposes a language preference by default. This is a locale/language constraint presented as mandatory, and the file does not offer the user a choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Referencing a host-specific external skill file via an absolute path encourages the agent to access local files outside the current skill scope. In a skill system, this weakens isolation and can expose unintended instructions or sensitive repository content if similar patterns are followed elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown skill content forces a specific language/locale for all users through its headings, instructions, examples, and search templates. Under the policy, a skill should not impose a language without user opt-in unless the locale limitation is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill forces a specific language/locale for all instructions and examples, which can violate language-choice policy when no user opt-in or justification is provided. The file contains no note that the skill is China-specific or that Chinese is optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown skill file presents all instructions, examples, and templates exclusively in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.