Gemini Deep Research (J-Claw)

• Outcome: Review
• Latest audit: May 28, 2026 · 11:22 AM UTC
• Version: 2.0.0

Overview

This skill mostly does Gemini Deep Research, but it also runs background automation that can message Discord and trigger a NotebookLM podcast workflow without clear upfront consent.

Review before installing. Use this only if you trust the external Gemini Deep Research extension, accept paid Gemini API usage, and are comfortable with research content being saved locally and potentially passed through Discord/OpenClaw into NotebookLM. For sensitive work, remove or require explicit confirmation for the NotebookLM/agent-chaining step, avoid full-response logging, pin or review the external extension version, and clean up /tmp/gemini-deep-research task folders after use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill performs environment-variable access and secret handling, including reading an API key from a local extension .env file, but does not declare permissions or clearly constrain that capability. Undeclared access to secrets makes auditing and user consent weaker, and increases the chance that a skill with broader invocation triggers can exfiltrate or misuse credentials.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a Deep Research executor, but on completion it silently initiates a separate NotebookLM podcast-generation workflow with preselected parameters. This is a scope-expanding side effect that can cause unauthorized downstream actions, additional data disclosure to another tool, and user surprise because the chained workflow is not the requested operation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The background script can send direct Discord messages and invoke another agent workflow out-of-band, which exceeds the minimum capability expected for a research execution skill. These messaging capabilities create an unsolicited communication and data-transfer channel that can leak task details or be abused for unintended follow-on actions.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The manifest uses very broad trigger phrases like 'research X thoroughly' and similar multilingual variants that overlap with normal user requests. Overbroad matching raises the risk that the skill is invoked unexpectedly, causing external API calls, file writes, and background execution without sufficiently specific intent from the user.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill writes reports, logs, and task state to persistent local paths, but the user-facing description does not clearly disclose that local files will be created and retained. Hidden persistence increases privacy risk, especially when research topics, report content, and full MCP responses may contain sensitive information.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The downstream chained workflow hard-codes zh-CN as the output language without user opt-in. While not severe by itself, it is another indicator that the skill performs hidden follow-on behavior and overrides user preferences in a separate workflow.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly log complete MCP responses and include user-supplied topic and output-path details in notifications and downstream agent messages. This creates a natural-language data exposure path where potentially sensitive research content, identifiers, or filesystem details are propagated beyond the original execution context and retained in logs.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `poll-research.js` | Polls `research_status` every 5 min until done/timeout |
| `save-report.js` | Calls `research_save_report` once status is `completed` |

All scripts read/write `task.json` in the task's temp directory.

---

• Confidence: 84% confidence
• Finding: The skill persists task state in a temp directory across turns using task.json and related files, enabling work to continue outside the immediate session. Session persistence is not inherently malicious, but here it increases risk because it stores research topics, output paths, and IDs without clear lifecycle controls or user-visible retention limits.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd /tmp/gemini-deep-research/<task-dir>/
nohup bash poll.sh > /dev/null 2>&1 &
echo "Background PID: $!"
```

• Confidence: 93% confidence
• Finding: Using nohup to launch poll.sh creates a detached background process that continues operating after the initiating interaction ends. This is risky because it enables autonomous execution, polling, notifications, and downstream tool invocation without further user review or active session control.

Session Persistence

Medium

• Category: Rogue Agent

Content

done
```

### Step 5 — Launch Background Process

```bash
cd /tmp/gemini-deep-research/<task-dir>/

• Confidence: 90% confidence
• Finding: The documented workflow explicitly includes launching a background process, confirming that the skill is designed for asynchronous execution beyond the current session. In this context, persistence becomes more dangerous because the job can keep polling, writing files, and sending messages or triggering other workflows after the user is no longer actively supervising it.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dr-client.js:131

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/poll-research.js:32

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/save-report.js:22

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/start-research.js:21