Security audit

deep-research-engine

Security checks for vulnerabilities and agentic risk

Overview

This research skill is not overtly malicious, but it asks for broad command execution and file/API capabilities that are not tightly scoped to passive research.

Install only if you are comfortable letting a research workflow use host command execution. Prefer running it in a sandboxed workspace, review commands before execution, avoid giving it secrets or private databases unless necessary, and direct outputs to a non-sensitive folder.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document claims command execution is restricted to a whitelist, but the skill only declares generic exec capability and includes no enforceable whitelist mechanism in the skill definition. This can mislead users and downstream agents into trusting unsafe command execution paths, increasing the risk of arbitrary shell commands being run under the guise of 'safe' research automation.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a public-information research tool, but it also advertises broad file processing, writing, API integration, and command execution capabilities unrelated to that narrow purpose. This capability overreach increases attack surface because a user or prompt injection could steer the agent into local file manipulation or shell activity beyond simple research/report generation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Generic system command execution is advertised as a normal feature even though the skill's stated purpose is research synthesis. In agent environments, unnecessary exec access materially raises risk because prompt injection, malicious inputs, or operator misunderstanding can turn a research task into arbitrary command execution on the host.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill describes writing reports, datasets, charts, and logs to filesystem paths without a clear user-facing warning about side effects or storage impact. While expected for a research skill, undocumented write behavior can surprise users and may enable overwriting or persistence of sensitive outputs in shared agent environments.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The runtime section states that exec capability is required but does not present a clear upfront warning about the implications of command execution. In an agent context, users may invoke the skill for passive research without realizing it may execute host commands, which meaningfully increases operational risk.

Static analysis

No suspicious patterns detected.