ars-deep-research

• Outcome: Review
• Latest audit: Aug 22, 2026 · 11:14 AM UTC
• Version: 2.12.2

Overview

This research skill is mostly coherent, but it needs review because it includes hidden opt-in user-behavior probes and broad local/external processing beyond a simple research assistant.

Install only if you are comfortable with a broad academic-research workflow that may read project files, process local PDFs, call bibliographic APIs, and write phase artifacts. Keep optional probes such as ARS_SOCRATIC_READING_PROBE disabled unless users are told that responses may be logged and carried into summaries. Require explicit activation and confirmation before monitoring, external provider/cross-model checks, local PDF processing, or shell-dispatched sidecar building.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (23)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill text explicitly instructs a shell-capable dispatcher to run a deterministic builder subcommand to create or update a preregistration sidecar. Even if framed as deterministic and bounded, this expands the skill from pure analysis into operational command execution, which creates an execution surface that can be abused if companion handles, paths, or builder inputs are attacker-controlled or insufficiently validated.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The file explicitly says consumer agents must never modify `literature_corpus[]`, then later instructs this agent to produce new per-entry fields. In a multi-agent pipeline, contradictory mutability rules create a trust-boundary failure: downstream components may treat user-supplied corpus data as immutable while this agent silently rewrites or augments it, enabling provenance corruption and misleading integrity signals.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This section defines a covert 'reading probe' that profiles whether a user has actually read a cited paper, while explicitly instructing the agent not to disclose the mechanism. That goes beyond normal research assistance into hidden behavioral assessment, which is risky because users are not informed that their responses are being evaluated and categorized.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The agent is instructed to emit hidden machine-readable tags containing paper identifiers, user outcomes, and excerpts of user responses for downstream review. This creates undisclosed monitoring and metadata generation about user behavior, which can be repurposed for profiling, auditing, or retention without the user's awareness.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README advertises very broad natural-language triggers such as generic terms for research help, fact-checking, and topic selection across multiple languages. In agent ecosystems that auto-select skills by trigger matching, this can cause unintended invocation, context hijacking, or routing away from a more appropriate skill, especially because many phrases are common in ordinary conversation.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger list includes broad natural-language phrases such as 'help me think through' and multilingual equivalents that can appear in ordinary conversation unrelated to invoking a 13-agent research workflow. Overbroad activation can cause the wrong skill to seize control, pull in unnecessary capabilities, and route user content into a more powerful multi-agent process than intended.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The file directs the system to detect intent by meaning rather than exact keywords and to prefer socratic activation whenever intent is ambiguous. This creates a fail-open routing policy: unclear input is treated as sufficient evidence to activate the skill, increasing the chance of unintended capture of user requests and cross-skill misrouting.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Monitoring triggers such as 'monitor this topic' and 'set up alerts' broaden the skill from one-shot research into ongoing surveillance-like behavior. In a skill with raw data access and open-ended orchestration, broad monitoring phrases can unintentionally enable persistent data collection or recurring actions beyond what the user expected from a research assistant.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The example hard-codes a language restriction to English and Chinese without documenting a user requirement, domain justification, or discussion of resulting selection bias. In a research skill, this can systematically exclude relevant evidence and produce skewed conclusions while appearing methodologically rigorous, especially for global topics like higher education quality assurance.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase "guide my research" is overly broad and can match many ordinary user requests that are not specifically asking for this high-scope skill. In an agent environment, ambiguous activation boundaries can cause unintended tool/skill invocation, leading to capability overreach, misrouting, or unexpected processing of user inputs.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The example hard-codes an English-only filter in a systematic review workflow without indicating that this restriction is user-requested, methodologically justified, or disclosed as a limitation requiring consent. In a research skill, this can systematically exclude relevant non-English evidence, bias conclusions, and mislead users into believing the review is comprehensive when it is not.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The document instructs the system to automatically switch to Chinese-language databases and continue in a Chinese-literature path when English results are sparse, without explicitly requiring user consent for that shift. In a research skill, this can override user expectations about language scope, source accessibility, and publication goals, potentially producing unusable or misleading outputs for users who need English-only or internationally verifiable sources.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger examples around review mode are broad enough to match common conversational requests like asking for help reviewing a paper or methodology, which can cause the skill to activate when the user may not explicitly intend to invoke this research pipeline. In an agent-routing system, overly broad activation increases the chance of unintended access to tool behavior, context capture, or workflow switching without clear user consent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The 'describe your situation → system auto-recommends a mode' path is ambiguous because it effectively allows very broad free-form input to trigger the skill-selection logic without defined boundaries. That makes accidental activation more likely and can route unrelated user requests into this skill, especially in environments with many overlapping agent skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The socratic trigger examples include everyday phrases like 'help me think through' and 'guide my research,' which are broad enough to overlap with ordinary assistant conversations and brainstorming requests. Because this mode is explicitly multi-turn and exploratory, accidental activation is especially risky: it can pull users into a long, opinionated workflow when they only wanted lightweight assistance.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger examples include broad natural-language phrases such as "set up alerts" and "track new publications on..." that are common in ordinary academic workflows and could cause this auxiliary skill to activate when the user did not explicitly request it. In a multi-agent environment, overbroad activation can route context into the wrong skill, leading to unintended instruction capture, confusing behavior, or policy bypass via premature delegation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: These lines embed mandatory Chinese-language operational references and validation-script instructions into a safety-critical human-subjects workflow without language choice or clear fallback. In a multi-agent research pipeline, this can cause operators or downstream agents to misinterpret compliance gates, skip required checks, or incorrectly claim unresolved administrative status, which is especially risky in IRB/human-subjects contexts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions require storing and later reproducing user paraphrases or other responses in logs and summaries without a clear user-facing warning at the time of collection. This is dangerous because users may provide copyrighted text, sensitive research notes, or identifiable information, which then gets preserved and exposed beyond the immediate conversation.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The hidden health-check log tracks interaction traits such as agreement patterns, conflict avoidance, and premature convergence without explicit disclosure. While framed as quality control, it still constitutes undisclosed behavioral monitoring that can affect user treatment and create trust and privacy concerns.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill explicitly instructs the agent to create a literature matrix and declares write-capable tools, but it does not require user confirmation before modifying workspace files. In an agent environment, silent file creation can overwrite analyst expectations, create unwanted artifacts, or contribute to prompt-to-action behavior without clear consent boundaries.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The prompt explicitly preserves candidate-paper identifiers and user responses, then reproduces them in machine-readable tags and end-of-session summaries. This creates a natural-language data leakage path because user-provided content can be propagated to other agents, logs, or reviewers outside the immediate context in which it was shared.

External Transmission

Medium

• Category: Data Exfiltration

Content

For every corpus entry in the user's `literature_corpus[]`:

1. If `doi` is present: call `https://api.crossref.org/works/<DOI>` and record `message.issued.date-parts[0]` as `crossref_issued.value`. Precision is `day` if all 3 date parts present; `month` if 2; `year` if 1.
2. If `source_pointer` references a local PDF (`file://...`): run `pdftotext -f 1 -l 1 <pdf>` and record the first non-empty line. Extract a `published_date_candidate` if a 4-digit year matching `\b(19\d{2}|20\d{2})\b` appears.
3. Compute `confidence` per the agreement table in spec §3.4 (10-row table covering all source-state × outcome combinations including Crossref outage).
4. Write the entry to `phase2_investigation/citation_provenance.yaml`.

• Confidence: 95% confidence
• Finding: The skill instructs the agent to send DOI-derived requests to Crossref and to process local PDFs via `pdftotext`, which creates an external data transmission path and local file handling surface. Even though the purpose is legitimate research metadata verification, DOI values, request timing, and associated corpus contents may reveal user research interests or sensitive document handling patterns to third parties.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

"$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/evidence/evidence_row_v1_2.schema.json",
  "title": "ARS Shared Evidence Row v1.2 — cross-document consistency",
  "description": "Closed observation-level evidence-row/1.2 carrier for the cross-document consistency advisory. One row integrity-binds the complete ordered bilateral or preregistration three-witness evidence set. Evidence and checked-scope states are caller-supplied semantic observations whose bytes are replayed; they are not agreement, completeness, readiness, acceptance, or authorization findings.",
  "type": "object",
  "additionalProperties": false,
  "required": [

• Confidence: 95% confidence
• Finding: This schema contains bidirectional/zero-width Unicode control characters in a regex used to reject unsafe paths, which is a classic metadata/tooling poisoning signal because such invisible characters can mislead reviewers and cause inconsistent interpretation across editors, validators, or downstream agents. In an agent skill context, schemas are trusted control-plane artifacts; hidden Unicode can undermine human review, bypass simplistic sanitizers, or create ambiguity in what inputs are actually allowed or denied.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/guides/chinese_literature_api_protocol.md:308