sn-deep-research

• Outcome: Review
• Latest audit: Aug 19, 2026 · 4:17 AM UTC
• Version: 2026.8.19

Overview

The skill’s research workflow is mostly coherent, but it launches an overbroad local web workbench that can expose or modify local files beyond normal research needs.

Review before installing. Use this only in a trusted environment, prefer binding the workbench to localhost instead of 0.0.0.0, avoid pointing it at sensitive directories, and be cautious with agent/API credentials because the bundled workbench exposes more than a passive research progress page.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly orchestrates file reads/writes, command execution helpers, and network-backed research, yet no declared permissions are surfaced in the metadata. That creates a transparency and policy-enforcement gap: a caller may invoke a skill with materially broader capabilities than the user-facing contract suggests, increasing the chance of unintended file access or outbound requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The stated purpose is deep research orchestration, but the skill also directs launch of a local web workbench, progress UI, file-tree/editor style functionality, local API interaction, and multiple validation/snapshot scripts. This mismatch matters because users and reviewers may consent to a research assistant while actually enabling a broader local-control and data-exposure surface, which can increase the blast radius if the skill or its dependencies are abused.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The research workbench entrypoint imports and executes a PPT workbench module, creating a capability/behavior mismatch between the advertised skill and the code actually run. This can route research requests through unintended logic, permissions, prompts, or toolchains, increasing the risk of incorrect task handling, data leakage across contexts, or invocation of functionality not expected for a research skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file implements a large Express-based local server plus deck-editing/export functionality that is unrelated to the declared purpose of a deep-research skill. Expanding a research-oriented skill into a local web app that can manipulate files, spawn tools, and serve endpoints greatly increases the attack surface and violates least-privilege expectations for the skill context.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code launches Chromium and elsewhere invokes external commands for conversion/export workflows, despite the skill being described as research-only. Subprocess and browser execution can be abused to access local data, execute untrusted tooling, or trigger unintended side effects, especially when combined with user-controlled deck content and file paths.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill persists slide HTML, assets, patches, and generated files to disk, enabling direct modification of local content well beyond analysis. In the context of a deep-research skill, this makes prompt-driven changes materially more dangerous because a user or malicious content could steer the system into altering files rather than only inspecting them.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The stylesheet performs an external network fetch via `@import` to Google Fonts, which causes clients loading the skill UI to contact a third-party domain. This leaks requester metadata such as IP address, user agent, timing, and referrer context outside the skill boundary, and the fetch is not necessary to implement deep-research logic itself.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger logic is intentionally over-broad and even prefers activation for vague phrases like '研究/了解一下 X', causing the skill to seize control in many borderline cases. In this skill's context, activation leads to filesystem operations, external web access, multi-agent orchestration, and possible local UI launch, so over-triggering materially raises the risk of unnecessary data access and tool use beyond user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs command execution, directory creation, file writes, web access, and environment-variable based credential use, but the high-level description does not clearly warn the user that invoking the skill may perform these actions. That weakens informed consent and can expose local data, secrets, or network interactions unexpectedly, especially because the workflow also starts a web UI and consumes environment-provided tokens.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The skill hard-requires a runtime-provided `language` and instructs the agent to author all natural-language output in that language rather than respecting the user’s language preference. This can cause silent policy or user-intent override, reduce usability, and in a security-sensitive research workflow may make review, auditing, or downstream human validation harder if output is forced into an unexpected language.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The skill explicitly binds all user-facing output to a payload-provided language/style contract and requires blocking on mismatch, without any visible requirement to preserve the user's original language preference or handle exceptions safely. This can let an upstream caller silently override user intent, mislead the user about what they are approving or reading, and reduce transparency in multilingual or safety-sensitive workflows.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the reviewer to always use the payload-provided `language` for headings, findings, suggestions, and completion output, explicitly forbidding adaptation based on the reviewed material or other context. If that payload field is attacker-controlled or mismatched with the user’s actual language preference, it can force output into an unintended language, causing user confusion, degraded review quality, and potentially hiding important security conclusions from the human reader.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill description explicitly mandates Chinese-language output for all self-written briefing fields and completion replies based on the payload language, which can override the user's actual preferred language if the payload is wrong or manipulated. In an agent system, forcing a language without user opt-in can degrade user comprehension, hide unsafe behavior from reviewers, and create downstream integrity issues in security-sensitive or compliance-sensitive workflows.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The schema explicitly requires `style_contract.language` to be copied verbatim from the payload and the example hard-codes `zh-Hans`, which can cause the skill to force Simplified Chinese output regardless of the user's actual language preference. In a research/report-generation skill, this can override user intent, degrade usability, and create downstream integrity issues if users rely on language-specific formatting, terminology, or compliance expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The process hooks force child processes to run with windowsHide=true, suppressing visible windows during execution. Hiding subprocess activity reduces user awareness and auditability, which is especially concerning when the same file also launches browsers and executes external commands outside the declared research scope.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file performs deck import/extraction and writes content, thumbnails, patches, and exports to disk without any evident user-facing disclosure at this layer. Silent filesystem writes are risky because they can change or proliferate local files while the skill is presented as a research assistant rather than a file-manipulation tool.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown renderer is configured with HTML support disabled at the parser level, but it still renders `html_block` and `html_inline` tokens by returning `e[t].content` verbatim, and the final component injects the rendered result with `dangerouslySetInnerHTML`. If untrusted markdown can reach this viewer through artifact content, raw HTML may execute or enable DOM injection/XSS, which is especially risky in a research/reporting skill that aggregates external content from many sources.

Missing User Warnings

Low

• Confidence: 97% confidence
• Finding: Importing fonts from `fonts.googleapis.com` silently sends client metadata to a third party whenever the UI loads. Even though this is common front-end practice, it creates an avoidable privacy exposure and cross-origin dependency without user-facing disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:505

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: workbench-runtime/dist-server/index.mjs:33609

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: workbench-runtime/dist-server/index.mjs:1030

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:126

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: workbench-runtime/dist-server/index.mjs:476

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: workbench-runtime/dist-server/index.mjs:2578

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: workbench-runtime/dist/assets/MarkdownArtifactViewer-C7xIspsK.js:2

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:88