ClawHub
Back to skill

Security audit

Deep Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local research client that sends search questions to a localhost API, with no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you intentionally run and trust the local Agentic RAG-CN service on port 18888. Avoid sending sensitive prompts unless you understand how that local service stores logs and which external search providers it contacts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims broad multi-source research and a web_search fallback, but the provided logic only posts the user's question to a local API and does not evidence either the 11-source access or the fallback behavior. This mismatch can mislead users and reviewers about where data goes and what guarantees exist, which is security-relevant when user queries may contain sensitive information.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill performs network-capable actions via curl to a local HTTP service but does not declare any tool scope or allowed-tools boundary. This weakens policy enforcement and reviewability, making it easier for the skill to invoke network behavior without explicit operator awareness.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The invocation guidance says to use the skill when the user asks for "deep research, comprehensive search, [or] multi-source search," which are broad natural-language phrases that could match many ordinary requests. The description does not provide tighter trigger constraints or negative examples to clarify when this skill should be chosen instead of normal search behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
Agentic RAG-CN must be running locally. Check with:

```bash
curl -s http://localhost:18888/health
```

If unavailable, fall back to built-in `web_search` tool.
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs forwarding the user's question to a local API but does not include any user-facing disclosure or consent language about that transmission. Even though the destination is localhost, it is still a separate service boundary that may log, retain, or further transmit sensitive prompts, creating privacy and data-handling risk.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The request and response examples use Chinese text for both the input question and the returned answer, which implies a fixed language expectation. The document does not offer a language choice or explain that the API is intentionally limited to a Chinese-language or region-specific use case.

Static analysis

No suspicious patterns detected.