Security audit

Deep Research Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed deep-research skill with a local report index; its file persistence is worth knowing about but fits the stated purpose.

Install if you want a research workflow that may use external search/fetch tools and, for deep or exhaustive work, save reports plus an index under ~/research. Do not use it for confidential research topics unless local storage and external lookup are acceptable; remove ~/research files manually if you no longer want the retained report history.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to save reports under ~/research and to use a local research index, which implies file read/write capability without any declared permissions or user-visible scoping. Undeclared filesystem access expands the trust boundary and can lead to unintended persistence, overwrites, or reading of local report data in contexts where the user only expected online research.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The published description presents the skill as a research agent, but the behavior includes maintaining a persistent local report database/index and searching local markdown contents. This mismatch is dangerous because users and orchestrators may route tasks to the skill expecting transient web research, while the skill can also access and manipulate accumulated local data, increasing the risk of unintended disclosure or unauthorized modification.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file implements a local report/index manager rather than a deep multi-source research capability described by the skill metadata. This mismatch matters because it introduces persistent storage and indexing behavior that can retain user-derived research data on disk without that capability being clearly justified, expanding the skill’s data-handling surface beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code creates and updates a filesystem-backed knowledge store under the user's home directory, allowing research metadata and links to persist across runs. In the context of a research agent, this is risky because collected topics, titles, tags, and report relationships may expose sensitive user interests or prior work, and the persistence is not obviously necessary from the manifest-described purpose.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad enough to match many ordinary requests such as 'look into' or 'find out about,' which can cause this more capable skill to activate in situations where a simpler, less privileged tool would suffice. Over-broad activation increases exposure to the skill's file persistence and local indexing behaviors, making accidental invocation and unintended data handling more likely.

Static analysis

No suspicious patterns detected.