Deep Search-mpro

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

The skill is mainly a research/report generator, but its bundled guidance expands into undeclared local skills, shell workflows, and automatic execution patterns that users should review before installing.

Review the reference docs before installing, especially the parts that invoke sibling skills or local scripts. Use it for public web research, avoid confidential topics unless you control all downstream tools, require explicit confirmation before searches/conversions, and do not run optional scripts or install companion skills without inspecting them first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The framework instructs the agent to load and depend on another skill from an absolute local filesystem path. This creates an unsafe trust boundary: a prompt-triggered workflow for web research should not implicitly access arbitrary local resources, and the referenced external skill could be modified, replaced, or contain unsafe instructions outside the reviewed package.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document inconsistently references both a relative document path and a different absolute path under another skill name. This ambiguity can cause the agent to load unintended content, bypass review assumptions, or execute a different dependency than the one operators believe is in use.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The document expands behavior beyond the skill’s stated scope by promising automatic DOCX and PPTX generation through other skills that are not declared in the manifest. This creates capability ambiguity and can cause unintended tool invocation, making it harder for users and reviewers to understand what data may be sent where and what outputs may be produced.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Claiming that users only need this skill while silently relying on other system skills obscures the true execution path and trust boundary. That weakens informed consent, reduces auditability, and may expose report contents to additional components the user did not expect to be involved.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The integration guide materially expands the effective capability surface of the skill by instructing the agent to invoke other local skills and tooling for PDF extraction, OCR, hotspot analysis, and Word/PPT generation. Even though this is documentation rather than executable code, in an agent setting such guidance can drive behavior beyond the declared deep-search scope, increasing the chance of unauthorized file access, unexpected local processing, and unreviewed transitive trust in other skills.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The guide includes shell execution patterns such as changing into local skill directories and running scripts directly from the user's home directory. In an agent environment, documentation that normalizes arbitrary local script execution and dependency inspection can lead to command execution beyond the stated research purpose, especially if an agent treats the guide as operational instructions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This example expands the skill from web_search/web_fetch-based research into orchestrating Figma API and Notion API integrations plus automation scripting, which exceeds the documented workflow and can mislead downstream agents into requesting, handling, or transmitting external credentials and data. Even though it appears in examples, example content often shapes real agent behavior, so undocumented capability expansion can create unauthorized data access, unsafe automation, or scope creep.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The example states analysis will auto-start after 10 seconds, which contradicts a confirmation-based workflow and teaches the agent to proceed without explicit user authorization. This can cause unintended searches, data fetching, and report generation, reducing user control and making consent boundaries ambiguous.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script is packaged with the deep-search-m skill, but its comments, status text, and dependency set refer to a different skill name, consulting-analysis. This can mislead operators into validating or installing the wrong dependencies, causing incorrect trust decisions, broken execution paths, or accidental use of unrelated skills in a security-sensitive agent environment.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Treating a bare AI tool name alone as sufficient to trigger the workflow is overly broad and can cause accidental activation from ambiguous user input. In an agent system, loose routing increases the chance of invoking the wrong skill, pulling in unnecessary external searches, and producing unintended outputs without explicit user consent.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The invocation rules include direct tool-name input without documented exclusion conditions or confidence thresholds. This makes routing ambiguous and increases the risk that unrelated user messages are interpreted as requests for this skill, leading to unintended searches and report generation.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Broad trigger phrases like requests for 'online viewing' or 'interactive report' can overlap with ordinary user intent and accidentally trigger HTML/frontend generation. This can lead to unnecessary tool execution and creation of richer outputs than the user explicitly requested, increasing both attack surface and surprise side effects.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow states that multiple output files may be generated and retained automatically, but does not warn users that local artifacts will be created. Unexpected file creation can leak sensitive report contents, clutter shared environments, and create persistence the user did not intend.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document says the AI will automatically call other system skills without explaining that report content may be passed to those skills for conversion. Even if this is expected internally, the lack of disclosure weakens transparency and can surprise users handling confidential business research.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Auto-starting operational steps after a timeout without a clear warning weakens informed consent and may trigger external actions before the user has approved scope, sources, or costs. In a research skill that performs web_search and web_fetch, this can lead to unintended network activity, premature data collection, or reports built on unconfirmed assumptions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: These examples normalize beginning analysis automatically without adequately warning users about the operational consequences, such as external searches, fetched content, and generated outputs. Repetition across example flows increases the chance that implementers or agents treat non-consensual execution as expected behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Presenting auto-start as the default behavior in later examples reinforces an unsafe interaction pattern in which the agent acts before the user has finalized requirements. In context, this skill performs live research actions, so premature execution can waste resources, collect irrelevant data, or violate user expectations around approval and scope control.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow explicitly permits analysis to begin after 10 seconds without an explicit user confirmation, which can cause the agent to proceed using inferred topic, scope, and defaults that the user may not have intended. In a research skill that performs web search/fetch and generates authoritative-looking reports, this increases the risk of acting on misunderstood requests and producing misleading or unwanted output.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The role-selection flow defaults to a user role after 10 seconds and proceeds automatically, meaning the system may tailor guidance and analysis to an audience the user did not choose. This can materially change the framing, recommendations, and resources in the generated report, reducing reliability and creating avoidable mismatch between user intent and system behavior.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.