深度调研 (Deep Research)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:40 AM UTC
• Version: 1.1.0

Overview

This appears to be a real research skill, but it mandates automatic report delivery through Feishu/current chat and uses prior memory without clear consent or scoping.

Review this before installing for sensitive work. It should be changed to require explicit confirmation before reading memory, saving files, converting PDFs, or sending anything through Feishu/current chat, and the README should accurately disclose web access, messaging, and PDF dependencies.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:490

Finding

Mandatory External Delivery of Potentially Sensitive Research Reports Without Explicit Consent

Content

View full analysis

", path: "/path/to/report.pdf", caption: "Research report delivered" }) ``` ``` ### Technical Analysis The Skill explicitly directs the Agent to transmit the completed report through Feishu without obtaining permission at the point of transmission. This instruction overrides a normal consent boundary by declaring that delivery is mandatory and not optional. External delivery can be a legitimate convenience, but it is not necessary to perform research or generate a local PDF. Research reports may contain confidential business questions, proprietary analysis, personal information, regulated data, or content retrieved from persistent memory. Automatically forwarding the complete report to a cloud messaging service therefore exceeds the minimum privileges needed for the declared research functionality. The target is represented by the placeholder ``, and no attacker-controlled endpoint is hard-coded. Consequently, the observed behavior i ...[truncated 1525 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:456

Finding

Unscoped Access to Persistent Cross-Session Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md2pdf.sh:121

Finding

Markdown-to-PDF Conversion Permits Unrestricted Resource Resolution

Content

View full analysis

/dev/null; then echo "[md2pdf] Using weasyprint" # Step 1: md → html with embedded CSS pandoc "$INPUT" -o "$HTML_FILE" \ --standalone \ --css="$CSS_FILE" \ --self-contained \ --metadata title="" \ 2>/dev/null # Step 2: html → pdf weasyprint "$HTML_FILE" "$OUTPUT" 2>/dev/null if [ $? -eq 0 ] && [ -f "$OUTPUT" ]; then echo "[md2pdf] ✅ Success: $OUTPUT" exit 0 fi echo "[md2pdf] ⚠️ weasyprint failed, trying next engine..." >&2 elif command -v wkhtmltopdf &>/dev/null; then echo "[md2pdf] Using wkhtmltopdf" pandoc "$INPUT" -o "$HTML_FILE" \ --standalone \ --self-contained \ --metadata title="" \ 2>/dev/null # Inject CSS into HTML if possible wkhtmltopdf --encoding utf-8 --page-size A4 --margin-top 20mm --margin-bottom 20mm --margin-left 22mm --margin-right 22mm "$HTML_FILE" "$OUTPUT" 2>/dev/null if [ $? -eq 0 ] && [ -f "$OUTPUT" ]; then echo "[md2pdf] ✅ Success: $OUTPUT" exit 0 fi echo "[md2pdf] ⚠️ wkhtmltopdf failed" >&2 ``` ### Technical Analysis The script passes report-controlled Markdown to Pandoc with `--self-contained`, then renders the resulting HTML with WeasyPrint or wkhtmltopdf. It does not validate resource URLs, sanitize raw HTML, restrict file references, disable renderer network access, or isolate the conversion process. Markdown and embedded HTML can reference remote images, stylesheets, or other resources. Pandoc’s self-contained processing may retrieve referenced resources so they can be embedded in the output. PDF renderers may also resolve URLs found in generated HTML. Depending on the installed engine and its configuration, local `file:` references may be readab ...[truncated 2009 chars]

Remediation

View remediation

other

Note

• Location: README.md:14

Finding

Misleading Offline and No-Cloud Security Claims

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to save reports, generate PDFs, and send them externally without user permission. That creates unauthorized side effects, risks exfiltrating potentially sensitive research content, and bypasses normal consent checks for local writes and outbound communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This later automation block reinforces mandatory local file writes, shell-based PDF conversion, and external message sending without prompting. Repetition of the requirement makes the behavior more likely to be followed by an agent and increases the risk of unauthorized data handling and exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README asserts 'No external dependencies' and 'Works offline', but the skill description and protocol rely on live web_search and web_fetch access. This misleading trust signal can cause users or reviewers to approve the skill under false assumptions about network usage, privacy exposure, and reproducibility boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comparison table reinforces the same inaccurate claims by contrasting the skill against cloud/API tools while omitting that it still performs external web retrieval. Such contradictions can materially mislead users about operational security properties, especially in regulated or sensitive research contexts where outbound access matters.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger phrases such as asking for 'deep research on...' or 'exhaustive analysis of...' may activate the skill for ordinary user requests that did not intend this high-cost, multi-step workflow. This can lead to unintended tool use, excessive data access, longer execution, and reduced user control if invocation boundaries are ambiguous.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest advertises only native research tools, but the body instructs the agent to write files, invoke a shell script, and send outbound Feishu messages. This mismatch hides privileged behaviors from reviewers and users, increasing the chance that an agent performs side effects the declared tool scope did not authorize or make obvious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states the tool is optimized for Chinese scenarios and automatically generates Chinese PDFs, but it does not offer users a language choice or make the language constraint an explicit opt-in. This can violate language or locale policy when the skill is invoked for users who did not request Chinese output.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The instruction to 'automatically execute' post-research actions delegates autonomous decisions over side-effecting operations to the agent. In this context, those actions include file writes and outbound delivery, so the autonomy directly weakens human approval boundaries and can lead to unauthorized disclosure.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

**⚠️ This skill requires AUTOMATIC PDF delivery. Do NOT stop after completing research.**

After completing the final report (Phase 4), you MUST automatically execute:

### ✅ Delivery Checklist (No User Permission Needed)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation examples include "Tell me everything about X," which overlaps with common conversational language and is not specific to this skill's intended activation context. The file does not provide negative examples or tighter constraints to prevent unintended invocation from ordinary requests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

This second autonomous-execution directive again instructs the agent to proceed without prompting or permission. Because it is attached to export and messaging actions, it materially increases the likelihood of unapproved external transmission of generated content.

Content

Scanner excerpt · SKILL.md (reported line 490)May include surrounding context.

⚠️ WARNING: Research is INCOMPLETE until PDF is delivered. This is NOT optional.

After completing the final report text, you MUST automatically execute these steps WITHOUT user prompting or permission:

✅ Step 1: Save Report as Markdown

bash

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The 'Auto-Execute' research cycle indicates the skill may autonomously launch multi-step web searches and fetches without an explicit per-step user confirmation boundary. In a research skill that uses external tools, this increases the risk of unbounded tool use, accidental collection of sensitive data, excessive external querying, and reduced human oversight over what sources are accessed and synthesized.

Content

Scanner excerpt · example.md (reported line 76)May include surrounding context.

md

---

## Phase 3: Research Cycles (Auto-Execute)

### Theme 1: Market Landscape — Cycle 1

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation phrase "deep research" is generic and can be triggered in many unrelated contexts, increasing the chance of accidental activation or prompt-routing into this powerful research workflow without explicit user intent. In a skill that performs multi-step autonomous web research, broad triggers are more dangerous because they can launch extensive external data collection and downstream actions based on ambiguous requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation establishes a user-controlled workflow with explicit stop points and a requirement to wait before proceeding. Elsewhere, the same document overrides consent expectations by stating that PDF delivery must occur automatically without user prompting or permission, creating an intent-level contradiction about when user approval is required in the workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Line L069 requires APA citations throughout, which imposes a specific formatting convention as a fixed policy rather than adapting to user preference. This is a natural-language constraint that may conflict with organizational or user locale/style expectations because no opt-in or alternative is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

Lines L201 and L212-L214 prescribe 'proper APA citations,' 'Academic narrative,' and 'Flowing prose only' as mandatory output constraints. While not a security flaw, this is a natural-language policy restriction that enforces a specific communication convention without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.