研究代理助手免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent research-document assistant, but it needs review because it exposes an unclear callback path and broad file-handling trigger while creating persistent local files.

Install only if you are comfortable with a research assistant creating persistent files under ~/.research-agent and possibly ~/specs. Do not use callback_url unless you explicitly trust the destination and know what content will be sent. Treat optional pandoc and PyMuPDF installation as separate software installs, preferably in a sandbox or virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:473

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 473
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| PyMuPDF | Python package | Optional | `pip install pymupdf` (PDF export) |

Technical Analysis

The skill recommends installing pymupdf from the package index without specifying an audited version, validating cryptographic hashes, using a lockfile, or restricting the package source. Consequently, the artifact installed when the command is run may differ from the artifact available when the skill was audited.

Python package installation may execute package-controlled build or installation logic. If the package publisher, distribution infrastructure, configured package index, or dependency chain is compromised, malicious code could execute with the privileges of the user running the agent.

This is an optional dependency associated with PDF export. The audited file does not specify a malicious source or demonstrate deliberate payload delivery.

Attack Path

1. A user requests functionality that requires PDF export.
2. The agent determines that the optional Python dependency is needed.
3. Following SKILL.md, the agent runs pip install pymupdf.
4. Pip resolves and downloads the current package from its configured index without checking an expected version or hash.
5. A compromised or substituted package executes malicious installation logic or installs malicious runtime code.
6. That code executes under the account and environment used to run pip or the subsequent PDF-export workflow.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the installation. Within those privileges, an attacker could read or alter accessible research documents, modify user-owned files, access environment data, or perform network operations.

The impact is generally limited to the installing user's permissio ...[truncated 199 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest available release:

   text

   pymupdf==<reviewed-version>
   

2. Store the dependency in a lockfile or requirements file containing cryptographic hashes, and install it using hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate and verify hashes from trusted artifacts before publishing the skill.
4. Restrict installation to an explicitly trusted package index and prevent unintended fallback to untrusted indexes.
5. Install the package in a dedicated virtual environment or other sandbox with minimal filesystem and network permissions.
6. Document that installation must not be performed with administrator or root privileges.
7. Periodically review the pinned package and its transitive dependencies for known vulnerabilities before updating the lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes creating folders and documents under a persistent local workspace without a prominent warning or explicit consent model for local writes. In an agent environment with read/write/exec tools, undocumented persistence can cause sensitive data retention, overwrite existing content, or create artifacts users did not expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims the free edition does not support API integration or automation, yet documents a callback_url for asynchronous completion notifications. This inconsistency can mislead operators into enabling outbound network callbacks and data transmission paths that were not expected or consented to, increasing the risk of unintended exfiltration or policy bypass.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented callback URL introduces outbound transmission of status or result data without any privacy, consent, or destination validation warning. Even if intended for convenience, callback features can leak research contents, metadata, or system details to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The capability boundary says deep asynchronous research and API integration are unsupported, but the input format still exposes an asynchronous callback mechanism. Security controls often rely on declared capability boundaries; contradictory documentation makes it easier to smuggle networked behavior into a supposedly local-only free tier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition is broad enough to activate the skill for generic file handling, document conversion, and content extraction tasks well beyond narrowly scoped research assistance. Overbroad activation increases the chance that the agent performs sensitive local file operations or transforms user data in contexts where the user did not clearly request this skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill intentionally persists research data and configuration under ~/.research-agent, creating durable local state across sessions. Persistent storage can accumulate sensitive prompts, findings, links, and metadata, which increases exposure if the host is shared, backed up insecurely, or later accessed by other tools or users.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

研究工作区配置

bash

# 创建研究工作区
mkdir -p ~/.research-agent/workspace/research
# ...
# 配置研究偏好
cat > ~/.research-agent/config.yaml << 'EOF'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

PDF 导出需要安装 pandoc。可通过系统包管理器安装.

bash

# 依赖说明
# Ubuntu: sudo apt install pandoc
# macOS: brew install pandoc
# Windows: choco install pandoc

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

Even the 'validation' example creates the workspace directory, which normalizes persistent state creation as a side effect of routine use. This can surprise users who only intended to test availability and can leave traces on disk without meaningful consent or cleanup.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

免费版基于 Markdown 指令驱动，无需额外 API Key.

bash

# 验证工作区可写
mkdir -p ~/.research-agent/workspace/research && echo "ok"
# ...
# 验证PDF导出工具（可选）
pandoc --version 2>/dev/null && echo "pandoc就绪" || echo "pandoc未安装（PDF导出不可用）"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example configuration sets language: "zh-CN", which imposes a specific locale in natural-language guidance. The file does not present this as optional or user-selectable, so it appears to prescribe a language setting without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.