Skilled Deep Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

This research skill is mostly purpose-aligned, but it needs review because it can auto-trigger broad multi-agent workflows and contains unsafe shell and file-write patterns.

Review before installing. Use this only in a constrained workspace, avoid sensitive research topics unless you are comfortable with persistent local logs, and do not pass arbitrary output paths. The maintainer should narrow activation, validate slugs/worker names/URLs/output paths, replace shell append templates with structured file APIs, and pin documented external tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:202

Finding

Shell Command Injection Through Interpolated User and Network Inputs

Content

View full analysis

> [DATA_DIR]/workers/retry-queue.md ``` ```bash exec: cat >> [DATA_DIR]/workers/[NAME]-results.md << 'ENDBLOCK' ### [SCORE/5] [Source Title](https://exact-url.com) - **Type:** official doc | github repo | reddit thread | blog | consulting page | other - **Relevance:** one sentence — why this matters for [TOPIC] - **Key findings:** - specific finding - specific finding - **Direct downloads:** https://direct.link/file.docx (or "none") - **Fetched:** 2026-03-07T00:00:00Z --- ENDBLOCK ``` ```bash exec: echo "[URL]" >> ~/.openclaw/workspace/skills-data/skilled-deep-research/[SLUG]/known-urls.txt ``` ### Technical Analysis The Skill instructs agents to interpolate user-controlled values and externally obtained URLs directly into shell command strings. Double quotes do not neutralize shell command substitutions such as `$(command)` or backticks. Newlines and other shell syntax can also alter the intended command. The URL values are particularly dangerous because they originate from untrusted web-search results. A malicious website can expose a crafted URL that becomes executable syntax when inserted into one of the mandatory `exec` templates. Topic, output path, slug, data-directory, worker-name, and error values present additional injection surfaces. The heredoc checkpoint pattern can also be disrupted if generated content contains the delimiter on a separate line, allowing subsequent content to be interpreted by the shel ...[truncated 1101 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init-run.sh:10

Finding

Path Traversal and Arbitrary File Writes Through Unvalidated Path Components

Content

View full analysis

[output_dir]}" TOPIC="${2:?Usage: init-run.sh [output_dir]}" OUTPUT_DIR="${3:-}" WORKSPACE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}" DATA_DIR="$WORKSPACE/skills-data/skilled-deep-research/$SLUG" mkdir -p "$DATA_DIR/workers" touch "$DATA_DIR/known-urls.txt" # Write meta.json cat > "$DATA_DIR/meta.json" <

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init-run.sh:20

Finding

Unsafe JSON Serialization and Stored Agent-Prompt Injection

Content

View full analysis

"$DATA_DIR/meta.json" </dev/null || echo 'unknown') Data dir: $DATA_DIR Your job: re-attempt every URL listed in $RETRY_FILE For each URL: 1. Try the fetch script first: /home/sean/.openclaw/workspace/lab/skills/ddg-search/scripts/fetch 2. If that fails (403/bot-block), try Playwright: mcporter call playwright.browser_navigate url= mcporter call playwright.browser_snapshot 3. If still fails, note as permanently failed in results.md Use the same results.md format as defined in SKILL.md. Append to: $DATA_DIR/workers/retry-results.md Update heartbeat: $DATA_DIR/workers/retry-progress.json When done, run: python3 ~/.openclaw/workspace/skills/skilled-deep-research/scripts/merge-reports.py $SLUG${OUTPUT:+ --output $OUTPUT}", label: "research-$SLUG-retry", model: "google/gemini-2.5-flash", runTimeoutSeconds: 1800 ) EOF ``` ### Technical Analysis `init-run.sh` generates JSON through direct shell interpolation rather than a JSON serializer. Quotes, backslashes, carriage returns, and newlines in the topic, slug, or output destination can make the document invalid or inject additional JSON properties. The stored topic and slug are later inserted directly into an agent task generated by `retry-run.sh`. They are not structurally delimited as untrusted data a ...[truncated 1365 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:152

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (12)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases include very common requests like 'research', 'find', 'look into', and 'investigate', which are likely to appear in normal conversation. That creates a high risk of unintended auto-invocation of a skill that can spawn sub-agents, execute shell commands, and write persistent files without the user explicitly opting in.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language examples include generic prompts like 'What is X?', 'Quick research on X', and 'Find templates', which strongly overlap with ordinary assistant use. In this skill, accidental activation is more dangerous because execution can lead to subprocess creation, persistent storage, and copying reports to arbitrary user-specified paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are broad enough to match common requests like "find" or "look into," which can cause the skill to activate unexpectedly. In this skill's context, activation is not passive: it may spawn multiple subagents, perform network access, and create persistent files, so overbroad matching increases the chance of unintended tool use and side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes persistent writes under ~/.openclaw/workspace/skills-data/... and copying reports to user-specified output paths, but it does not prominently warn users that invoking the skill has filesystem side effects. In combination with broad auto-triggering and multi-agent execution, this can lead to unexpected data creation, storage of sensitive research topics, or writes to unintended locations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute an MCP server via npx playwright-mcp without pinning a version or integrity constraint. That exposes installs to supply-chain risk because a future compromised or breaking package release would be fetched and executed implicitly, and MCP servers often run with significant local access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command npx clawhub install seanford/skilled-deep-research relies on an unpinned clawhub package, so users may execute whatever version is current at install time. This creates a supply-chain execution path in documentation, where a malicious or compromised release could run arbitrary code during skill installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly performs file reads, file writes, shell execution, and uses external tooling, yet it declares no explicit tool scope or permissions boundary. This increases the chance the platform grants broader capabilities than users expect, making unintended file-system access and command execution harder to govern or audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill persists working data under a long-lived skills-data directory and can copy final reports to user-specified output paths, but this behavior is not prominently disclosed as a user-facing warning. Users may unknowingly trigger retention of searched topics, fetched URLs, and generated reports, creating privacy and integrity risks on shared systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Tier selection is based on vague words such as 'quick', 'brief', 'summary', 'research', and topic length, which can misclassify ordinary requests into automated workflows. Because different tiers change execution behavior materially, ambiguous boundaries can unexpectedly escalate from inline response to multi-agent execution and file writes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill intentionally appends every fetched URL to a persistent known-urls registry and stores per-run research artifacts across sessions. While useful for deduplication and checkpointing, this creates session persistence of user activity and research history that may expose sensitive interests or data over time if access controls or retention are weak.

Content

Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.

md

ENDBLOCK

   ⚠️ You MUST use this shell append pattern. Do NOT use write/edit tools for results.
   Do NOT buffer multiple entries — write each one immediately after fetching.

6. Append URL to known-urls.txt (FULL PATH — critical for deduplication):
   exec: echo "[URL]" >> ~/.openclaw/workspace/skills-data/skilled-deep-research/[SLUG]/known-urls.txt

Tainted flow: 'report_path' from os.environ.get (line 204, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

The destination path used by shutil.copy2 is influenced by untrusted input via --output or meta.json output_dir, and the base workspace path also comes from the OPENCLAW_WORKSPACE environment variable. This allows the script to write the generated report to an attacker-chosen filesystem location, which can overwrite arbitrary files the current user can access. In this skill context, report content is aggregated from worker outputs and may include attacker-controlled text, making arbitrary file write more dangerous than a simple convenience feature.

Content

Scanner excerpt · scripts/merge-reports.py (reported line 216)May include surrounding context.

python

if out.is_dir():
            out = out / "report.md"
        out.parent.mkdir(parents=True, exist_ok=True)
        shutil.copy2(report_path, out)
        print(f"Copied to: {out}")

    # Update meta.json

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script generates instructions for a spawned worker to use Playwright browser automation as a fallback when direct fetching fails. In a research skill, automated browsing may be functionally relevant, but delegating unrestricted navigation to arbitrary retry-queue URLs increases capability beyond simple search/fetch and can interact with attacker-controlled pages, expanding exposure to risky content, SSRF-like access through a browser context, or unintended authenticated/session-bearing requests depending on the runtime environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.