autonomous-deep-research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed local research helper with some rough documentation and local-learning behavior, but I did not find artifact-backed deception, exfiltration, destructive behavior, or unsafe automatic persistence.

Reasonable to install if you understand it is a simple local research orchestrator, not a fully autonomous deep-research system. Treat learner.py as optional local logging; do not store secrets, private research notes, or sensitive preferences in it unless you are comfortable with plaintext learned_patterns.json on disk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose and the detected behavior diverge significantly: the skill claims deep research functionality, but analysis indicates those core features are not implemented while undeclared persistence/logging behavior exists instead. This is dangerous because users may trust the skill with sensitive research inputs under false expectations, while hidden storage or telemetry can collect data and the missing controls around retrieval/validation can lead to unsafe or deceptive operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises behavior that implies shell execution and file writing, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: a caller or platform may permit broader capabilities than intended, and users cannot easily assess what the skill is allowed to do before invoking it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content of the skill forces a specific language presentation for users, and the file does not offer an opt-in choice for another language or explain that the skill is intended only for a Chinese-speaking context. This matches the policy category for language or locale constraints without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest promises deep-research behaviors like multi-source retrieval, cross-verification, coverage reflection, confidence calibration, and online/offline operation. This file performs none of those functions; it initializes and updates a local JSON log of capabilities, errors, preferences, and reflective suggestions, so its actual behavior does not match the manifest's described research operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill focused on autonomous deep research: decomposing questions, retrieving sources, synthesizing evidence, and iterating toward answers. This file instead implements a reusable telemetry/learning module for any WorkBuddy skill, including storing user preferences and usage/error histories, which is a broader capability not justified by the stated research-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persists arbitrary preference values and free-form notes to learned_patterns.json without any consent, minimization, redaction, or retention controls. In practice, notes and preferences often contain sensitive user data, prompts, internal identifiers, or research content, so local disk persistence can create unintended disclosure to other local users, backups, or later components that read the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/research.py (reported line 46)May include surrounding context.

python

idx_file = os.path.join(SELF_DIR, "research_index.json")
    if rag and os.path.exists(rag) and os.path.exists(idx_file):
        tmp = os.path.join(SELF_DIR, f"rag_q_{idx}.json")
        r = subprocess.run([sys.executable, rag, "--index", idx_file, "--question", sub,
                           "--topk", "2", "--out", tmp], capture_output=True, text=True, timeout=60)
        if r.returncode == 0 and os.path.exists(tmp):
            try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/research.py (reported line 60)May include surrounding context.

python

wf = CAP_SCRIPTS.get("web_fetch")
    if wf and os.path.exists(wf):
        tmp = os.path.join(SELF_DIR, f"web_q_{idx}.json")
        r = subprocess.run([sys.executable, wf, "--query", sub, "--out", tmp],
                           capture_output=True, text=True, timeout=90)
        if r.returncode == 0 and os.path.exists(tmp):
            try:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language interface and usage guidance are presented only in Chinese, which forces a specific language for users without indicating choice or locale scoping. This matches the policy category for language or locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.