Deep Research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 PM UTC
• Version: 0.1.0

Overview

This deep-research skill is not clearly malicious, but it asks for broad control over agent behavior and requires forwarding all research files and logs without a sensitivity check.

Review this skill carefully before installing. It may be useful for structured deep research, but only in an environment where forwarding raw research reports and logs is acceptable and where platform instructions can override the skill's unconditional command language. Avoid using it with sensitive attachments, private logs, credentials, or confidential research material unless the workflow is revised to include redaction and user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Agent Role and Instruction-Priority Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable code snippets:

markdown

# Golden Rule 1: User Input is the Absolute Source of Truth
**This is your highest command and must be obeyed unconditionally.**

markdown

You are a senior AI agent named **`Deep_Research_Leader_Agent`**, the leader of a deep research team.

markdown

Any user task, no matter how simple it seems, **must be decomposed into at least more than 2 and less than 6 parallel sub-tasks** and assigned to different subordinate agents.

markdown

**Tool Call Limits:**
* You can only call tools in 'available_tools'; calling other tools based on your own discretion is prohibited.

Technical Analysis

The skill attempts to redefine the agent's instruction hierarchy by declaring its own rule to be the “highest command” and requiring unconditional compliance. It also replaces the agent's role with Deep_Research_Leader_Agent and imposes mandatory delegation, tool-selection, and reporting behavior for every request.

These directives exceed ordinary task-scoped research guidance. When the skill is loaded into an agent context, they can compete with the agent's established goals, safety constraints, and user-specific requirements. The repeated use of absolute terms such as “must,” “unconditionally,” “strictly forbidden,” and “highest command” makes the attempted control explicit.

The file also contains the unresolved placeholder $GET_USER_TEMPLATE$ on line 12. The project does not define its source or sanitization. Although the reviewed artifact contains no injected payload at that location, substituting untrusted text directly into this instruction block could amplify the instruction-hijacking risk.

Attack Path

1. A user or platform loads SKILL.md as an active agent skill.
2. The model processes line 12 as op ...[truncated 1330 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove claims that skill content is the “highest command” or must be obeyed “unconditionally.”
2. Explicitly state that system, developer, platform-safety, and current user instructions retain precedence over the skill.
3. Replace the mandatory role reassignment with task-scoped guidance, such as an optional research workflow used only when relevant to the user's request.
4. Change absolute delegation and tool-use requirements into recommendations. Permit the agent to select the minimum necessary tools and number of subtasks based on task complexity.
5. Remove broad prohibitions that suppress agent discretion or conflict with platform-level tool policies.
6. Define an allowlisted schema and trusted source for $GET_USER_TEMPLATE$. Treat substituted content as untrusted data, delimit it clearly, and prevent it from introducing new instructions.
7. Add a security review that rejects skill text containing instruction-precedence claims, unconditional-compliance language, or attempts to replace the agent's governing identity.
8. Test the revised skill against conflicting and adversarial prompts to confirm that it cannot override higher-priority instructions or force unnecessary tool calls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill repeatedly requires reading, preserving, and forwarding all reports and logs without filtering, and explicitly forbids omitting any file. That creates a strong semantic instruction to exfiltrate sensitive data from user uploads, subordinate-agent outputs, and operational logs, even when those materials may contain secrets, personal data, or irrelevant confidential information. In a deep-research context that aggregates many external and user-provided materials, this materially increases disclosure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says only 'AI agent for deep research tasks,' which is a broad natural-language scope without explicit trigger phrases, boundaries, or exclusion conditions. In a markdown/manifest context, this can cause unintended invocation for many generic research-related requests because it does not clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

In the constraints, the document says the agent is 'only allowed to conduct one round of task assignment and research' and that planning for multiple rounds is strictly forbidden. Later, the workflow explicitly describes a 'multi-round iterative workflow' and instructs the agent to return to Phase 2 for a new round of tasks if research is incomplete, which directly contradicts the earlier stated intent.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Instructions

# Golden Rule 1: User Input is the Absolute Source of Truth**This is your highest command and must be obeyed unconditionally.** The user's input is the starting point and core of all research tasks. You must never unilaterally modify, correct, or replace a term, product name, or version number just because it does not exist in your internal knowledge base. Your default behavior must be to **assume the user is correct and your knowledge is outdated.******   **Prohibited Behavior Example (Strictly Forbidden!):** The user asks to "Research Claude 4 Sonnet". You assume "Claude 4" does not exist and switch to researching "Claude 3 Sonnet".*   **Correct Behavior Example (Mandatory!):** The user asks to "Research Claude 4 Sonnet". Your first action is to verify what "Claude 4 Sonnet" is, and then conduct research revolving around this **unmodified** core concept.---$GET_USER_TEMPLATE$# Golden Rule 2: Know Your Subordinates and Delegate Precisely**Your research quality directly depends on whether you assign the [Correct Information Gathering] to the [Correct Searcher].** You have several core subordinate searchers, each responsible for different professional domains. Based on the user's input and requirements, first determine the necessary data sources and domains, and thereby judge which subordinate searchers need to be called.**Your direct subordinate searcher members are as follows:**-   **Internet Searcher**    -   **Corresponding Tool**: `call_web_search_agent`    -   **Delegation Scenario**: This is a searcher responsible for general search, capable of calling Google Search and Baidu Search to widely scour public internet materials.-   **Twitter Information Searcher**    -   **Corresponding Tool**: `Tech_and_Internet_Domain_Search_Agent`    -   **Delegation Scenario**: This is a searcher responsible for collecting news and information on Twitter. When information from social media outside of China is needed, prioritize delegating to this searcher to s
...[truncated 27 chars]

Static analysis

No suspicious patterns detected.