深度调研 (Deep Research)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:40 AM UTC
• Version: 1.1.0

Overview

This appears to be a real research skill, but it mandates automatic report delivery through Feishu/current chat and uses prior memory without clear consent or scoping.

Review this before installing for sensitive work. It should be changed to require explicit confirmation before reading memory, saving files, converting PDFs, or sending anything through Feishu/current chat, and the README should accurately disclose web access, messaging, and PDF dependencies.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:490
• Finding: Mandatory External Delivery of Potentially Sensitive Research Reports Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 490-515; also introduced at lines 18-25 **Vulnerability Type**: Unauthorized external data transmission through instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```markdown ### 🚨 MANDATORY: Post-Report Automation **⚠️ WARNING: Research is INCOMPLETE until PDF is delivered. This is NOT optional.** After completing the final report text, you MUST automatically execute these steps **WITHOUT user prompting or permission**: #### ✅ Step 1: Save Report as Markdown ```bash # Save to research directory with date ~/openclaw/workspace/research/[topic]-[YYYY-MM-DD].md ``` #### ✅ Step 2: Convert to PDF ```bash #### ✅ Step 2: Convert to PDF ```bash SKILL_DIR="$(dirname "$(readlink -f "$0")")" || SKILL_DIR="$(dirname "$0")/.." $SKILL_DIR/scripts/md2pdf.sh /path/to/report.md /path/to/report.pdf ``` #### ✅ Step 3: Send PDF to User ```javascript message({ action: "send", channel: "feishu", // or current channel target: "<user_id>", path: "/path/to/report.pdf", caption: "Research report delivered" }) ``` ``` ### Technical Analysis The Skill explicitly directs the Agent to transmit the completed report through Feishu without obtaining permission at the point of transmission. This instruction overrides a normal consent boundary by declaring that delivery is mandatory and not optional. External delivery can be a legitimate convenience, but it is not necessary to perform research or generate a local PDF. Research reports may contain confidential business questions, proprietary analysis, personal information, regulated data, or content retrieved from persistent memory. Automatically forwarding the complete report to a cloud messaging service therefore exceeds the minimum privileges needed for the declared research functionality. The target is represented by the placeholder `<user_id>`, and no attacker-controlled endpoint is hard-coded. Consequently, the observed behavior i ...[truncated 1525 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the phrases requiring delivery “without user prompting or permission.” - Default to saving the report locally and presenting its path to the user. - Request explicit, informed approval immediately before every external transmission. - Display the destination channel, resolved recipient, file path, file size, and sensitivity warning in the approval prompt. - Never infer a recipient from unrelated session or memory data. - Add a local-only mode that disables all messaging integrations. - Apply data-loss-prevention checks before delivery, including detection of credentials, personal information, and regulated data. - Record delivery consent and outcome without logging report contents or sensitive identifiers. - Allow administrators to disable Feishu delivery at the policy level. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:456
• Finding: Unscoped Access to Persistent Cross-Session Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 456-464 **Vulnerability Type**: Excessive access to persistent memory **Risk Level**: Medium ### Vulnerable Code ```markdown ### Memory Search Integration Before starting research, check for relevant prior knowledge: ``` → memory_search(query="previous research on [topic]") → memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found] ``` Use prior findings to: - Avoid duplicate research - Build on previous conclusions - Identify how understanding has evolved - Note persistent gaps from prior research ``` ### Technical Analysis The Skill instructs the Agent to search and read persistent memory before starting research. It does not require user consent, restrict access to records created by this Skill, define an allowed directory, or require verification that retrieved information belongs to the current user and topic. Persistent memory can contain material from previous sessions, unrelated tasks, or other sensitive contexts. A broad semantic query may return records that only partially match the current topic. Once retrieved, those records can influence the report and may subsequently be included in the mandatory Feishu delivery workflow. This is a least-privilege violation: prior-session memory can improve efficiency, but it is not required to conduct new web research. No evidence shows that the Skill writes malicious rules into memory, so this is not memory poisoning. The issue is excessive read access and possible onward disclosure. ### Attack Path 1. Persistent memory contains confidential information from an earlier session. 2. A later research request uses a broad or overlapping topic. 3. The Skill automatically invokes `memory_search`. 4. A semantically related memory file is returned even though it was not intended for the current report. 5. The Agent invokes `memory_get` and incorporates some of the retrieved information into its analysis. 6. The generated report i ...[truncated 756 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make persistent-memory access opt-in for each research request. - Explain why memory is useful and identify the intended topic before requesting consent. - Restrict retrieval to a Skill-owned namespace, current user, current project, and explicitly approved date range. - Use metadata filters rather than unrestricted semantic matching. - Present candidate memory records to the user before reading their full contents. - Treat retrieved memory as sensitive and prohibit inclusion in externally delivered reports without separate approval. - Redact secrets, personal information, and unrelated content before synthesis. - Add provenance labels to report text derived from persistent memory. - If the platform cannot enforce per-user and per-project isolation, disable memory integration by default. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md2pdf.sh:121
• Finding: Markdown-to-PDF Conversion Permits Unrestricted Resource Resolution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/md2pdf.sh`, lines 121-153 **Vulnerability Type**: Unsafe processing of Markdown-controlled external and local resources **Risk Level**: Medium ### Vulnerable Code ```bash # Detect available PDF engine and convert if command -v weasyprint &>/dev/null; then echo "[md2pdf] Using weasyprint" # Step 1: md → html with embedded CSS pandoc "$INPUT" -o "$HTML_FILE" \ --standalone \ --css="$CSS_FILE" \ --self-contained \ --metadata title="" \ 2>/dev/null # Step 2: html → pdf weasyprint "$HTML_FILE" "$OUTPUT" 2>/dev/null if [ $? -eq 0 ] && [ -f "$OUTPUT" ]; then echo "[md2pdf] ✅ Success: $OUTPUT" exit 0 fi echo "[md2pdf] ⚠️ weasyprint failed, trying next engine..." >&2 elif command -v wkhtmltopdf &>/dev/null; then echo "[md2pdf] Using wkhtmltopdf" pandoc "$INPUT" -o "$HTML_FILE" \ --standalone \ --self-contained \ --metadata title="" \ 2>/dev/null # Inject CSS into HTML if possible wkhtmltopdf --encoding utf-8 --page-size A4 --margin-top 20mm --margin-bottom 20mm --margin-left 22mm --margin-right 22mm "$HTML_FILE" "$OUTPUT" 2>/dev/null if [ $? -eq 0 ] && [ -f "$OUTPUT" ]; then echo "[md2pdf] ✅ Success: $OUTPUT" exit 0 fi echo "[md2pdf] ⚠️ wkhtmltopdf failed" >&2 ``` ### Technical Analysis The script passes report-controlled Markdown to Pandoc with `--self-contained`, then renders the resulting HTML with WeasyPrint or wkhtmltopdf. It does not validate resource URLs, sanitize raw HTML, restrict file references, disable renderer network access, or isolate the conversion process. Markdown and embedded HTML can reference remote images, stylesheets, or other resources. Pandoc’s self-contained processing may retrieve referenced resources so they can be embedded in the output. PDF renderers may also resolve URLs found in generated HTML. Depending on the installed engine and its configuration, local `file:` references may be readab ...[truncated 2009 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Parse and sanitize Markdown before conversion; reject raw HTML unless explicitly required. - Permit only approved URI schemes and reject `file:`, `ftp:`, `data:`, and other unnecessary schemes. - Block loopback, private, link-local, multicast, and cloud metadata destinations after DNS resolution. - Prefer a strict allowlist of trusted HTTPS domains when remote assets are necessary. - Pre-download approved resources through a controlled fetcher, validate MIME type and size, and rewrite references to isolated local copies. - Run Pandoc and the PDF renderer in a sandbox with no network access and a minimal read-only filesystem. - Use renderer-specific controls to disable local-file access and JavaScript. - Apply CPU, memory, file-size, and execution-time limits to conversion. - Generate output in a dedicated directory that is not readable by unrelated users. - Add automated tests using remote URLs, loopback URLs, metadata-service addresses, and local-file references to verify that resource access is blocked. ]]>

other

Note

• Location: README.md:14
• Finding: Misleading Offline and No-Cloud Security Claims<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 14-21 **Vulnerability Type**: Misleading security and privacy documentation **Risk Level**: Low ### Vulnerable Code ```markdown - ✅ **Works offline** — No API keys, no cloud services ## Comparison with Cloud-Based Research Tools | Feature | This Skill | Cloud API Wrappers | |---------|------------|-------------------| | Methodology | Fully documented | Black box | | Dependencies | None | External API + key | | Offline | ✅ Yes | ❌ No | ``` The same README later describes mandatory research through network-oriented tools: ```markdown ### Phase 3: Execution (Auto) For each theme, two full cycles: - `web_search` (count=20) for landscape - Analysis and gap identification - `web_fetch` on primary sources ``` In addition, `SKILL.md` requires delivery through Feishu. ### Technical Analysis The documentation states that the Skill works offline, uses no cloud services, and has no external dependencies. Those claims conflict with the declared use of `web_search`, `web_fetch`, and external Feishu delivery. The executable PDF workflow also depends on external programs such as Pandoc and either WeasyPrint or wkhtmltopdf, even though they are detected rather than automatically installed. This inconsistency can cause users and administrators to approve the Skill under an incorrect threat model. In particular, a user may believe that research data and generated reports remain local when the operational instructions require network access and external delivery. This is not evidence of credential theft or a hidden attacker endpoint. It is a security-relevant documentation defect that obscures the Skill’s actual data flows and dependency requirements. ### Attack Path 1. A user or administrator reviews the README during installation. 2. The explicit offline and no-cloud claims lead them to approve the Skill for sensitive data. 3. The user submits confidential research material under the assumptio ...[truncated 775 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the claims that the Skill works offline, uses no cloud services, and has no external dependencies. - Document every network-capable tool and external processor, including web search, web fetching, and Feishu. - Describe what data each service receives and whether reports are retained by third parties. - List runtime dependencies accurately: Pandoc and at least one supported PDF renderer. - Clearly distinguish optional network features from required behavior. - If offline operation is desired, implement a genuine local-only mode that disables search, fetch, memory access, and messaging. - Add a concise data-flow and permissions section to the README. - Keep README claims synchronized with `SKILL.md` through automated documentation checks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to save reports, generate PDFs, and send them externally without user permission. That creates unauthorized side effects, risks exfiltrating potentially sensitive research content, and bypasses normal consent checks for local writes and outbound communication.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This later automation block reinforces mandatory local file writes, shell-based PDF conversion, and external message sending without prompting. Repetition of the requirement makes the behavior more likely to be followed by an agent and increases the risk of unauthorized data handling and exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The README asserts 'No external dependencies' and 'Works offline', but the skill description and protocol rely on live `web_search` and `web_fetch` access. This misleading trust signal can cause users or reviewers to approve the skill under false assumptions about network usage, privacy exposure, and reproducibility boundaries.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comparison table reinforces the same inaccurate claims by contrasting the skill against cloud/API tools while omitting that it still performs external web retrieval. Such contradictions can materially mislead users about operational security properties, especially in regulated or sensitive research contexts where outbound access matters.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Broad trigger phrases such as asking for 'deep research on...' or 'exhaustive analysis of...' may activate the skill for ordinary user requests that did not intend this high-cost, multi-step workflow. This can lead to unintended tool use, excessive data access, longer execution, and reduced user control if invocation boundaries are ambiguous.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest advertises only native research tools, but the body instructs the agent to write files, invoke a shell script, and send outbound Feishu messages. This mismatch hides privileged behaviors from reviewers and users, increasing the chance that an agent performs side effects the declared tool scope did not authorize or make obvious.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description states the tool is optimized for Chinese scenarios and automatically generates Chinese PDFs, but it does not offer users a language choice or make the language constraint an explicit opt-in. This can violate language or locale policy when the skill is invoked for users who did not request Chinese output.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**⚠️ This skill requires AUTOMATIC PDF delivery. Do NOT stop after completing research.**

After completing the final report (Phase 4), you MUST automatically execute:

### ✅ Delivery Checklist (No User Permission Needed)

• Confidence: 97% confidence
• Finding: The instruction to 'automatically execute' post-research actions delegates autonomous decisions over side-effecting operations to the agent. In this context, those actions include file writes and outbound delivery, so the autonomy directly weakens human approval boundaries and can lead to unauthorized disclosure.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation examples include "Tell me everything about X," which overlaps with common conversational language and is not specific to this skill's intended activation context. The file does not provide negative examples or tighter constraints to prevent unintended invocation from ordinary requests.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**⚠️ WARNING: Research is INCOMPLETE until PDF is delivered. This is NOT optional.**

After completing the final report text, you MUST automatically execute these steps **WITHOUT user prompting or permission**:

#### ✅ Step 1: Save Report as Markdown
```bash

• Confidence: 97% confidence
• Finding: This second autonomous-execution directive again instructs the agent to proceed without prompting or permission. Because it is attached to export and messaging actions, it materially increases the likelihood of unapproved external transmission of generated content.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---

## Phase 3: Research Cycles (Auto-Execute)

### Theme 1: Market Landscape — Cycle 1

• Confidence: 87% confidence
• Finding: The 'Auto-Execute' research cycle indicates the skill may autonomously launch multi-step web searches and fetches without an explicit per-step user confirmation boundary. In a research skill that uses external tools, this increases the risk of unbounded tool use, accidental collection of sensitive data, excessive external querying, and reduced human oversight over what sources are accessed and synthesized.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation phrase "deep research" is generic and can be triggered in many unrelated contexts, increasing the chance of accidental activation or prompt-routing into this powerful research workflow without explicit user intent. In a skill that performs multi-step autonomous web research, broad triggers are more dangerous because they can launch extensive external data collection and downstream actions based on ambiguous requests.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The documentation establishes a user-controlled workflow with explicit stop points and a requirement to wait before proceeding. Elsewhere, the same document overrides consent expectations by stating that PDF delivery must occur automatically without user prompting or permission, creating an intent-level contradiction about when user approval is required in the workflow.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Line L069 requires APA citations throughout, which imposes a specific formatting convention as a fixed policy rather than adapting to user preference. This is a natural-language constraint that may conflict with organizational or user locale/style expectations because no opt-in or alternative is offered.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: Lines L201 and L212-L214 prescribe 'proper APA citations,' 'Academic narrative,' and 'Flowing prose only' as mandatory output constraints. While not a security flaw, this is a natural-language policy restriction that enforces a specific communication convention without user opt-in.

Static analysis

No suspicious patterns detected.