Security audit

Deep Research Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible web-research helper, but its install instructions and runtime behavior leave enough control and provenance gaps that users should review it carefully before installing.

Install only from a verified package or pinned, publisher-controlled repository. Expect the skill to send research queries and fetched URLs to external sites, create persistent report files under ~/clawd/research, and potentially use a sub-agent workflow; avoid sensitive topics or private/internal URLs unless you are comfortable with that exposure.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Unpinned and Inconsistent Git Repository Used for Manual Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:23-27` **Related Location**: `SKILL.md:5` **Vulnerability Type**: Untrusted and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code `README.md:23-27`: ```bash ### Manual ```bash cd your-workspace/skills git clone https://github.com/parags/deep-research-pro.git ``` ``` The repository differs from the homepage declared in `SKILL.md:5`: ```yaml homepage: https://github.com/paragshah/deep-research-pro ``` ### Technical Analysis The manual installation procedure clones the mutable default branch of a remote Git repository without pinning a reviewed commit, verifying a signed release, or validating a checksum. Consequently, the installed content can change after this artifact has been reviewed. The installation repository uses the GitHub account `parags`, while the declared homepage uses `paragshah`. The reviewed files do not establish that these accounts or repositories are controlled by the same trusted publisher. This inconsistency can result from a documentation error, but it also creates typosquatting and repository-substitution risk. No malicious code was present in the audited artifact, and exploitation requires the referenced repository to be malicious or compromised. ### Attack Path 1. An attacker controls or compromises the `parags/deep-research-pro` repository, or takes advantage of the inconsistent repository identity. 2. The attacker modifies its default branch to include malicious Skill instructions, scripts, package hooks, or other executable content. 3. A user follows the documented manual installation procedure. 4. Git downloads the current attacker-controlled default branch without integrity or signature verification. 5. The user or Agent loads the downloaded Skill or invokes its scripts. 6. Malicious content then executes with the permissions of that user or Agent process. ### Impact Assessment The initial `git clone` only writes remote repository co ...[truncated 820 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Identify and document one canonical, publisher-verified repository. Make the installation URL and the `homepage` field identical. 2. Pin manual installation to a specific reviewed commit or cryptographically signed release rather than a mutable default branch. 3. Publish SHA-256 checksums for release archives and require users or installers to verify them before loading the Skill. 4. Use signed Git tags or release artifacts and document signature verification steps. 5. Ensure the package registry version contains all advertised files so users do not need to retrieve unaudited components from another source. 6. Add automated release checks that reject mismatched repository owners, homepage URLs, package versions, and file manifests. 7. If cloning remains necessary, use a verified tag and explicitly check out the expected commit: ```bash git clone --branch v1.0.2 --depth 1 https://github.com/VERIFIED_OWNER/deep-research-pro.git cd deep-research-pro test "$(git rev-parse HEAD)" = "EXPECTED_FULL_COMMIT_HASH" ``` 8. Review the pinned repository contents, especially executable scripts and lifecycle hooks, before recommending installation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

External Script Fetching

High

Category: Supply Chain
Content: For the most promising URLs, fetch full content: ```bash curl -sL "<url>" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text
Confidence: 90% confidence
Finding: The workflow fetches arbitrary URLs and pipes the content directly into a Python process for parsing. Although the Python snippet is static and does not execute fetched content as code, this pattern still enables server-side request behavior against untrusted URLs, can access internal or local resources if attacker-controlled URLs are included, and processes unbounded remote content without validation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation trigger is extremely broad, telling the agent to run for research on any topic. Overbroad activation can cause the skill to engage in unintended contexts, increasing the chance it performs web access, file writes, or delegated actions when a simpler or safer behavior was expected.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs saving reports to the local filesystem without warning the user or requesting consent. Silent file creation can surprise users, leak sensitive research topics into persistent storage, and enable accumulation of data in predictable locations.

Skill Enumeration

Medium

Category: Agent Snooping
Content: ``` sessions_spawn( task: "Run deep research on [TOPIC]. Follow the deep-research-pro SKILL.md workflow. Read /home/clawdbot/clawd/skills/deep-research-pro/SKILL.md first. Goal: [user's goal] Specific angles: [any specifics] Save report to ~/clawd/research/[slug]/report.md
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The README states that the skill performs 'Full-page content fetching for deep reads' and elsewhere describes web and news search, but it does not warn users that the tool will make outbound network requests to third-party sites based on their queries and requested URLs. For markdown files, omitting such disclosure can be a missing user warning because it affects privacy and network behavior.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This markdown file documents a file-writing capability ('Save to file') and later shows the `--output FILE` option, but it does not include any user warning about writing data to disk or potential overwrite effects. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.

Description-Behavior Mismatch

Low

Confidence: 80% confidence
Finding: The documentation describes the skill as 'self-contained' and emphasizes that no paid APIs are required, but the implementation depends on a separate DDG search script at a fixed filesystem path and on curl being installed. This is a mismatch between the claimed packaging/scope and the actual operational dependencies documented in the file.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The manifest describes a research skill that searches the web, synthesizes findings, and delivers cited reports. The 'For Sub-Agent Usage' section adds orchestration behavior via sessions_spawn, which is not an obvious requirement for the core research function and expands the skill into agent management.

Static analysis

No suspicious patterns detected.