ClawHub
Back to skill

Security audit

meta-autonomous-deep-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it combines broad autonomous research guidance with persistent self-evolution notes that are not tightly scoped or user-controlled.

Review this skill before installing if you do not want research tasks to leave cross-session learner notes. Only use it in environments where local RAG/web access and skill-owned memory are acceptable, and avoid passing sensitive data into the learner note field unless you add retention and redaction controls.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill appears to perform local file persistence (for example, writing reflection or learner state) without declaring corresponding permissions. Undeclared write capability weakens transparency and consent boundaries, making it easier for a skill to modify local state, leave artifacts, or accumulate data outside the user's expectations.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The declared purpose presents a research/meta-reasoning skill, but the behavior also includes local persistence of operational statistics and notes via JSON/CLI recording. This mismatch is dangerous because operators may authorize the skill for research tasks without realizing it also stores execution data, which can create privacy, integrity, and policy-compliance risks.

Vague Triggers

Medium
Confidence
75% confidence
Finding
The invocation guidance is extremely broad ('directly call this skill' for the domain) and does not define clear trigger conditions, boundaries, or prohibited contexts. Overly permissive invocation increases the chance the skill is applied in unsuitable situations, potentially activating persistence, self-evolution, or orchestration behaviors more widely than intended.

Static analysis

No suspicious patterns detected.