ClawHub
Back to skill

Security audit

Deep Researcher

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed research-paper workflow with expected external source lookups and a limited local QA helper, with no evidence of hidden exfiltration, persistence, or privilege abuse.

Before installing, expect this skill to run substantial web research against public sources and possibly produce local paper, source, and QA report files. Use it when you want a full research-paper workflow, and review outputs carefully because the included QA script has correctness issues and should not be treated as a reliable validator.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is generating research papers, but the detected behavior includes reading local files such as research_paper.md and sources.json and writing qa_report.txt for validation/QA workflows. This mismatch is dangerous because users and policy systems may authorize the skill under a benign content-generation label while it performs additional local data access and modification operations that were not clearly disclosed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill declares no explicit tool scope or permissions while static analysis indicates file read/write capabilities. In an agent framework, undeclared local file access weakens transparency and policy enforcement, making it easier for the skill to access or modify workspace files beyond what a user would reasonably expect from a research-paper generator.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad, including terms like 'comprehensive analysis' and 'academic paper', which are likely to match ordinary writing or analysis requests unrelated to this high-capability workflow. Overbroad triggers increase the chance of unintended activation, causing unnecessary web queries, file operations, or lengthy automated actions in contexts where the user did not intend to invoke this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md
- **Query format**: `?db=pubmed&term=search&rettype=abstract&retmax=50`

### World Bank Open Data
- **URL**: `https://api.worldbank.org/v2/`
- **Best for**: GDP, demographics, development indicators by country
- **No API key required**
- **Format**: JSON, `?format=json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data_sources.md (reported line 22)May include surrounding context.

md
- **Query format**: `?db=pubmed&term=search&rettype=abstract&retmax=50`

### World Bank Open Data
- **URL**: `https://api.worldbank.org/v2/`
- **Best for**: GDP, demographics, development indicators by country
- **No API key required**
- **Format**: JSON, `?format=json`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
- **Format**: JSON, `?format=json`

### IMF Data API
- **URL**: `https://api.imf.org/v1/`
- **Best for**: Macroeconomic indicators, financial data
- **Free registration available**
- **Coverage**: World Economic Outlook, financial soundness indicators

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data_sources.md (reported line 28)May include surrounding context.

md
- **Format**: JSON, `?format=json`

### IMF Data API
- **URL**: `https://api.imf.org/v1/`
- **Best for**: Macroeconomic indicators, financial data
- **Free registration available**
- **Coverage**: World Economic Outlook, financial soundness indicators

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md
- **Mostly open access**

### Semantic Scholar
- **URL**: `https://api.semanticscholar.org/`
- **Best for**: CS academic papers with citation graphs
- **Free tier available**

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data_sources.md (reported line 39)May include surrounding context.

md
- **Mostly open access**

### Semantic Scholar
- **URL**: `https://api.semanticscholar.org/`
- **Best for**: CS academic papers with citation graphs
- **Free tier available**

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md
- **Free tier available**

### Hugging Face Hub API
- **URL**: `https://api.huggingface.co/`
- **Best for**: AI/ML model trends, dataset discovery, recent papers
- **Free tier**: 60 requests/hour

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data_sources.md (reported line 44)May include surrounding context.

md
- **Free tier available**

### Hugging Face Hub API
- **URL**: `https://api.huggingface.co/`
- **Best for**: AI/ML model trends, dataset discovery, recent papers
- **Free tier**: 60 requests/hour

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
- **Free tier**: 60 requests/hour

### GitHub API
- **URL**: `https://api.github.com/`
- **Best for**: Code trends, repository statistics, developer activity
- **Free tier**: 60 requests/hour (unauthenticated)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data_sources.md (reported line 49)May include surrounding context.

md
- **Free tier**: 60 requests/hour

### GitHub API
- **URL**: `https://api.github.com/`
- **Best for**: Code trends, repository statistics, developer activity
- **Free tier**: 60 requests/hour (unauthenticated)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill whose purpose is generating 30-40 page academic research papers with citations, but this file implements only post-generation validation and report writing. While quality checks may support the broader workflow, the code's actual operation is materially different from the claimed paper-generation behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring says the function verifies all 7 main chapters are present, yet the implementation ignores the listed chapter names and instead checks only for three synthetic strings: chap8, chap9, and chap10. This is an active contradiction between the function's stated intent and its actual logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The checklist requires 'Consistent APA 7th format throughout,' which imposes a single writing standard in natural language. Because the file does not mention user opt-in or justify why APA is mandatory, this can be read as forcing a specific standard without flexibility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.