Security audit

sn-deep-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real deep-research workflow, but it also starts a powerful unauthenticated workbench that can expose files, editing actions, and agent-session access beyond what users would expect.

Install only if you are comfortable with a research skill launching a local-network-accessible workbench. Prefer running it on loopback only, without broad environment secrets, and avoid using it in shared networks or workspaces containing sensitive files until authentication, path containment, and narrower agent-credential handling are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:126
Finding: Unauthenticated Workbench Exposed to the Local Network
Content: View full analysis
{ console.log(`ppt-editor server listening on http://${host}:${port}`); }); ``` ### Technical Analysis The launcher supports binding the workbench to `0.0.0.0` or `::` and deliberately generates a LAN-accessible URL for that configuration. The documented workflow also instructs the agent to launch and publish the research progress interface. The Express application registers sensitive API routes without global authentication or authorization middleware. There is no session-token validation, access-control layer, `Origin` validation, or equivalent protection before the workbench, workspace, chat, file, editing, export, and shutdown handlers are registered. A progress interface legitimately requires local HTTP access, but exposing all privileged backend APIs to the LAN is not necessary for that functionality and exceeds least privilege. ### Attack Path 1. The Skill starts the workben ...[truncated 1096 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: workbench-runtime/dist-server/index.mjs:38664
Finding: Unauthenticated Prompt Relay Uses the Owner's Agent Session and Credentials
Content: View full analysis
{ try { const message = requireString(request.body?.message, "message"); const result = await sendWorkbenchChat(message, request.body?.context); response.status(result.ok ? 200 : 409).json(result); } catch (error) { next(error); } }); app.post("/api/chat/send/stream", async (request, response, next) => { response.setHeader("Content-Type", "text/event-stream"); response.setHeader("Cache-Control", "no-cache, no-transform"); response.setHeader("Connection", "keep-alive"); response.flushHeaders?.(); const send = (event) => { if (response.destroyed) { return; } const eventType = typeof event === "object" && event && "type" in event ? String(event.type) : "message"; response.write(`event: ${eventType}\n`); response.write(`data: ${JSON.stringify(event)}\n\n`); }; try { const message = requireString(request.body?.message, "message"); await streamWorkbenchChat(message, request.body?.context, send); response.end(); } catch (error) { if (!response.destroyed) { send({ type: "error", status: "Agent relay failed.", error: error instanceof Error ? error.message : "Agent relay failed." }); response.end(); } else { next(error); } } }); ``` The launcher supplies the bridge with privileged session and credential material: ```javascript const sourceSessionId = String( args['source-session-id'] || args['agent-session-id'] || process.env.WORKBENCH_AGENT_SOURCE_SESSION_ID || process.env.HERMES_SESSION_KEY || '', ) const agentApiKey = String( ...[truncated 1913 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: workbench-runtime/dist-server/index.mjs:38656
Finding: Caller-Controlled Workspace Attachment Enables Local File Exposure
Content: View full analysis
{ try { const sourcePath = requireString( request.body?.sourcePath, "sourcePath" ); response.json(await openSenseNovaWorkspace(sourcePath)); } catch (error) { next(error); } }); ``` Related file APIs include: ```javascript app.get("/api/decks/:deckId/files", async (request, response, next) => { try { const deckId = requireString(request.params.deckId, "deckId"); response.json(await listDeckFiles(deckId)); } catch (error) { next(error); } }); ``` ### Technical Analysis The workspace-opening endpoint accepts a caller-controlled `sourcePath` and resolves it as a local filesystem path. The attachment logic recursively scans the selected location and recognizes workbench artifacts such as HTML and JSON files. There is no authentication, user confirmation, configured workspace-root restriction, or canonical containment check on `sourcePath`. Once a directory has been attached, manifest and deck file routes can expose recognized content through HTTP. The intended workflow only needs access to the report or deck directory selected at launch. Permitting arbitrary process-readable paths is broad ...[truncated 1064 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: workbench-runtime/dist-server/index.mjs:38531
Finding: Unauthenticated Destructive and Artifact-Mutation Endpoints
Content: View full analysis
{ const payload = { ok: true, pid: process.pid, message: shutdownScheduled ? "Workbench server shutdown is already scheduled." : "Workbench server is shutting down." }; response.once("finish", scheduleShutdown); response.json(payload); }); ``` ```javascript app.post("/api/slides/edit/apply", async (request, response, next) => { try { const payload = request.body; const deckId = requireString(payload.deckId, "deckId"); const pageNo = Number.parseInt( String(payload.pageNo ?? "1"), 10 ); const slide = await loadSlideDocument(deckId, pageNo); const preview = await previewDirectEdit(slide, payload); if (!preview.validation.ok) { response.status(422).json(preview.validation); return; } await persistPatchRecord(deckId, preview.patch); const deck = await persistSlideHtml( deckId, pageNo, preview.patchedHtml, "edited" ); const nextSlide = await loadSlideDocument(deckId, pageNo); response.json({ deck, slide: nextSlide, patch: preview.patch }); } catch (error) { next(error); } }); ``` ```javascript app.post("/api/export/pptx", async (request, response, next) => { try { const deckId = requireString(request.body?.deckId, "deckId"); const { audit, auditPath } = await auditDeck(deckId); const exportAttempt = await runConfiguredExport(deckId, "pptx"); response.json({ status: exportAttempt.ok ? "completed" : "ready", audit, auditPath, format: exportAttempt.format, artifactPath: exportAttempt.artifactPath, artifactUrl: exportA ...[truncated 1554 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: workbench-runtime/dist-server/index.mjs:32736
Finding: Deck Identifier Is Not Constrained Before Filesystem Path Construction
Content: View full analysis
{ try { response.json(await loadDeckBundle(request.params.deckId)); } catch (error) { next(error); } }); app.post("/api/decks/load", async (request, response, next) => { try { const deckId = requireString(request.body?.deckId, "deckId"); response.json(await loadDeckBundle(deckId)); } catch (error) { next(error); } }); ``` ### Technical Analysis `getDeckDirectory` joins a request-derived identifier to `decksRoot`, but the reviewed code does not establish a strict deck-ID syntax or verify that the resolved directory remains under the canonical root. Other slide-level path handling includes containment checks, but those controls do not correct the initial trust boundary for `deckId`. Encoded separators or traversal segments may cause metadata, file, edit, audit, or export operations to resolve outside the intended deck directory. Practical exploitation depends on route decoding behavior and the presence of filenames expected by individual deck operations. Nevertheless, the missing root-containment invariant is a confirmed filesystem boundary flaw. ### Attack Path 1. An attacker accesses a deck route accepting `:deckId` or a body-supplied `deckId`. 2. The attacker supplies a traversal-form identifier containing `..`, encoded separators, or another path-altering value. 3. The route passes the identifier into a filesystem-backed deck function. 4. `path.join(decksRoot, deckId)` resolves the resulting path without enforcing canonical containment. 5. If the ...[truncated 485 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:472
Finding: Entire Parent Environment and Multiple Credentials Are Propagated to the Web Server
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:487
Finding: Environment-Configurable Export and Agent Commands Increase Command-Execution Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (54)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 描述与代码的主用途明显不一致。描述把该 skill 定义为一个“深度研究/系统调研”类能力，触发条件也围绕研究任务、政策/市场核查、竞品分析和报告产出展开；但提供的代码只是一个命令行 JSON 校验脚本，验证 briefing.json 是否符合预设 schema/contract，并返回错误列表或简单统计。它不联网、不搜索资料、不分析竞品、不核查事实、也不生成研究报告。因此这不是实现细节层面的差异，而是 primary purpose 的根本性不一致，应判定为 mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个“研究执行/信息核查”型 skill：应在用户提出深度研究、系统分析、趋势分析、事实核查等需求时被调用，并承担多来源取证、交叉验证、形成报告的职责。而代码并未实现这些能力。它只读取本地 JSON 文件，校验 evidence 数据结构、ID/字段模式、source URL 格式、claim 与 evidence 引用关系、plan 中 dimension 是否存在、mode 是否匹配等，然后返回错误列表或统计信息。虽然代码中出现 evidence、plan、research mode 等研究流程术语，但其作用是研究产物的格式与质量约束校验，而不是执行研究本身。因此其主要用途与声明存在实质性偏差，属于明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个“深度研究/事实核查”类技能，核心能力应是信息检索、跨来源证据整合、比较分析和报告产出。但提供的代码完全没有这些行为。脚本仅通过 argparse 接收文件路径，读取本地 JSON 文件，校验 outline、evidence subset 与 evidence 引用关系，检查字段是否符合预定义枚举、正则格式、唯一性、必填项和跨文件引用是否可解析，最后输出校验结果。其主要用途是数据/文档结构验证，而不是研究执行。两者在主要目的、能力范围、资源访问方式和触发场景上都明显不一致，因此属于显著描述—行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向研究任务编排/执行的能力：在特定用户意图下主动触发，进行系统性信息收集、核验和报告产出。但代码仅实现了对 plan.json 的静态结构和业务规则校验，属于输入验证/模式检查工具。它不包含网络访问、搜索、数据采集、事实核查、分析生成或报告输出逻辑。尽管校验对象与“研究计划”有关，代码的主目的仍是验证计划文件是否符合 contract，而不是执行研究任务本身。因此描述与实际行为存在明显且实质性的用途错配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个“深度研究/调研”类技能，核心能力应包括信息搜集、交叉验证、竞品/趋势/政策分析、事实核查及报告产出。但提供的代码完全没有网络访问、搜索、知识整合或报告生成逻辑。它只是对 supplement_plan.json 进行严格的 schema 与业务约束校验，并检查其与 plan.json 的一致性，以及补充项状态是否为 newly generated 的 pending/空 resolution_note。该行为与声明的主要用途明显不符，属于主目的和能力层面的实质性错配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个‘深度研究/调研/事实核查’技能，预期行为应包含信息检索、跨来源核验、研究报告生成或至少与研究触发条件相关的调度逻辑。但代码中没有任何搜索、抓取、联网研究、事实核查、数据整合、竞品分析或报告生成能力。相反，它实现的是 MarkdownArtifactViewer：包含 markdown-it 风格的 Markdown 解析器、链接解析/linkify、HTML 实体处理、图片和链接渲染、Mermaid 脚本加载与 SVG 渲染、暗色主题监听，以及读取并展示 markdown 文件内容的 React 组件。这与声明用途在主要目的和实际能力上明显不一致，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码内容明显是通用前端框架与运行时基础设施，而不是一个执行“深度研究”任务的技能实现。它处理的是浏览器中的 link[rel="modulepreload"] 预加载、React 元素创建、hooks、调度、ReactDOM/Portal 等底层渲染机制。这些都属于 UI/应用运行支持代码。虽然其中有 fetch(e.href, n) 用于预加载模块资源，但这只是静态资源加载，不是面向用户请求的外部研究、搜索或证据采集。基于给定代码片段，声明的主要用途与实际行为存在实质性不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个“深度研究/事实核查”类技能，核心能力应是信息检索、跨来源核验、研究报告产出与系统性分析。但代码片段并未体现任何与搜索、数据采集、研究流程、事实核查或报告生成相关的逻辑；相反，它是典型的 React/React Router 前端运行时代码，负责 DOM 属性处理、事件系统、资源加载、导航和渲染。其主要目的与声明完全不同，属于明显的描述—行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个‘在特定用户研究请求下主动使用的深度研究 skill’，核心能力应是研究任务触发、跨来源检索、证据交叉验证、报告生成等。提供的代码却是大型前端 bundle 片段，主要是 React Router、i18next、本地化文案、工作台 UI 和若干 fetch API 封装。虽然代码中出现了 deepResearch 页面文案、研究生命周期标签和聊天/审计/文件读取接口，但这些更像是工作台界面与通信层，不体现声明中的核心研究行为，也没有看到主动根据用户触发词决定启用 skill、执行多来源取证、生成研究结论的代码。因此该代码的实际主要用途与声明用途存在明显偏差，属于实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个“深度研究/事实核查”型 skill，应当体现为检索、聚合多来源信息、对比分析、验证事实并生成研究报告的逻辑。但提供的代码没有表现出任何研究工作流、搜索/抓取外部来源、交叉验证或报告生成能力。相反，代码核心围绕一个工作台前端：调用本地 API 进行幻灯片检查与应用、上传 deck 资源和附件、导出内容、显示 AI agent 状态、系统状态，以及渲染菜单、图标、模态框和文件预览。这不是声明用途的支撑实现细节，而是完全不同的主要功能域，因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是“深度研究/调研/事实核查”类 skill，重点应是基于多来源检索、交叉验证、生成研究报告等能力。代码中未见执行外部信息检索、聚合多来源证据、事实核查流程或研究报告生成的逻辑；相反，代码围绕一个 workbench UI 展开，处理 deck、slide、HTML patch、AI 修改预览、审计建议填入输入框、导出文件以及 agentBridge 同步等。虽然代码里出现了 audit、deepResearch、AI 分析等字样，但其实际对象是本地/当前工作区页面与演示文稿工件，不是用户主题的互联网研究。故代码主目的与声明严重不符，且包含多项未声明的编辑器/导出/工作区管理能力，应判定为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is configured to trigger on extremely broad, everyday phrases like '研究', '了解一下 X', '调查', and similar wording, and it instructs the controller to proactively use the skill instead of answering normally. In context, this is dangerous because the skill also requires probing tool readiness, launching subprocesses, starting a WebUI, creating directories/files, and coordinating network-capable child agents, so casual user requests can unnecessarily escalate into a high-capability workflow.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · agents/report-writer.md (reported line 137)May include surrounding context.
md
## Step 3: execute the content-unit contract ### Common output rules - 文件内不得出现 H1。 - `render_contract.show_heading=true` 时第一条非空行是 `## {unit.title}`；false 时直接输出结构本体。

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements a full deck-editing/export workbench server despite the skill being declared as deep research only. This violates least privilege and materially expands the attack surface with file mutation, export, screenshot, and chat-bridge capabilities that a research skill does not need.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code invokes external processes via execSync, execFile, and spawn for browser automation, exports, screenshots, ACP, and agent bridging. In a research-only skill, this is dangerous because it enables command execution paths that can be influenced by environment configuration and operational inputs, greatly increasing RCE and abuse risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file ingests directories, uploads assets and attachments, reads and writes deck HTML/JSON, persists patches, and serves files back over HTTP. That is far outside a deep-research skill’s declared scope and creates opportunities for unauthorized local content modification, sensitive file exposure, and persistence of attacker-controlled data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Configured export commands are assembled from environment-controlled templates and executed with execSync, which invokes a shell. If an attacker can influence environment variables or deployment configuration, they can turn export into arbitrary command execution on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file launches an Express server with many API endpoints, static hosting, chat relays, export routes, and SPA routes, none of which are necessary for a research helper. Exposing a networked interactive application under a research skill substantially widens the remote attack surface and makes every other risky capability reachable over HTTP.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code includes runtime/session control operations such as reading runtime status and issuing a shutdown request, which are unrelated to a deep-research skill. Even if intended for convenience, embedding operational controls in an over-scoped skill enables misuse or unexpected service disruption if the UI is exposed in a context that only expected research functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code can open non-research workspaces and switch among editor/progress/workbench flows, which exceeds the documented deep-research purpose. This overreach increases the chance of confused-deputy behavior, where a workflow selecting the skill for research inadvertently triggers access to broader application surfaces or data contexts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill orchestrates file I/O, command execution, web search, and web fetching, but it declares no explicit tool scope or permission boundary. In a multi-agent research workflow, missing least-privilege constraints increases the chance that child agents can access environment secrets, arbitrary files, or network resources beyond what is necessary for the task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly requires all agent-authored natural language to follow a runtime-provided language field rather than the user’s expressed preference. This can override user intent, reduce transparency, and cause responses or written artifacts to appear in an unexpected language, which is a prompt-safety and policy-alignment issue even though it does not directly enable code execution or data exfiltration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill directs writing {report_dir}/plan.json to an absolute path provided by the task payload without any disclosure or visible guardrails. Even if intended for normal operation, writing to a user-influenced path can overwrite files, place artifacts in sensitive locations, or enable data placement abuses when path constraints are not enforced by a trusted layer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs execution of a Python validator subprocess but does not disclose this side effect in the markdown. Hidden execution behavior is risky because it can surprise users and reviewers, and when combined with payload-controlled paths it increases the chance of untrusted code execution or unintended local effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The plan skill is supposed to generate a planning artifact, but it additionally instructs the agent to execute python3 {plan_validator_path} {report_dir}/plan.json. Running a subprocess from a path supplied in payload expands the skill's authority from content generation into code execution, creating command-execution risk if the validator path or referenced file is malicious or improperly controlled.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:505

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: workbench-runtime/dist-server/index.mjs:33609

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: workbench-runtime/dist-server/index.mjs:1030

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:126

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: workbench-runtime/dist-server/index.mjs:476

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: workbench-runtime/dist-server/index.mjs:2578

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: workbench-runtime/dist/assets/MarkdownArtifactViewer-C7xIspsK.js:2

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: workbench-runtime/bin/sensenova-ppt-workbench.mjs:88