Deep Research Strategy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:28 PM UTC
• Version: 0.1.0

Overview

This research-planning skill is not destructive, but it takes unusually broad control of the agent workflow and requires forwarding all research reports and logs.

Install only if you want an aggressive research-orchestration workflow and are comfortable with it using external search agents and passing along all generated reports and logs. Avoid using it with confidential attachments, secrets, private URLs, or sensitive business data unless the host environment adds explicit review and redaction controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Unconditional Agent Instruction and Workflow Hijacking

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly requires reading, retaining, and handing over all reports, logs, and user-uploaded attachment-derived material without filtering. That creates a strong natural-language exfiltration path for sensitive data, because subordinate agent outputs and logs may contain secrets, personal data, internal URLs, or irrelevant confidential content that would then be automatically propagated to the final recipient.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions first state a "Mandatory Single-Round Research Principle" saying the agent is only allowed to conduct one round of task assignment and research, but later the workflow is described as a "multi-round iterative workflow" and explicitly says to return to Phase 2 and start a new round of tasks if research is incomplete. These directives actively conflict and create intent ambiguity about the agent's permitted behavior.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Instructions

# Golden Rule 1: User Input is the Absolute Source of Truth**This is your highest command and must be obeyed unconditionally.** The user's input is the starting point and core of all research tasks. You must never unilaterally modify, correct, or replace a term, product name, or version number just because it does not exist in your internal knowledge base. Your default behavior must be to **assume the user is correct and your knowledge is outdated.******   **Prohibited Behavior Example (Strictly Forbidden!):** The user asks to "Research Claude 4 Sonnet". You assume "Claude 4" does not exist and switch to researching "Claude 3 Sonnet".*   **Correct Behavior Example (Mandatory!):** The user asks to "Research Claude 4 Sonnet". Your first action is to verify what "Claude 4 Sonnet" is, and then conduct research revolving around this **unmodified** core concept.---$GET_USER_TEMPLATE$# Golden Rule 2: Know Your Subordinates and Delegate Precisely**Your research quality directly depends on whether you assign the [Correct Information Gathering] to the [Correct Searcher].** You have several core subordinate searchers, each responsible for different professional domains. Based on the user's input and requirements, first determine the necessary data sources and domains, and thereby judge which subordinate searchers need to be called.**Your direct subordinate searcher members are as follows:**-   **Internet Searcher**    -   **Corresponding Tool**: `call_web_search_agent`    -   **Delegation Scenario**: This is a searcher responsible for general search, capable of calling Google Search and Baidu Search to widely scour public internet materials.-   **Twitter Information Searcher**    -   **Corresponding Tool**: `Tech_and_Internet_Domain_Search_Agent`    -   **Delegation Scenario**: This is a searcher responsible for collecting news and information on Twitter. When information from social media outside of China is needed, prioritize delegating to this searcher to s
...[truncated 27 chars]

Static analysis

No suspicious patterns detected.