Academic Deep Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:46 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate research workflow, but it needs Review because it can read persistent agent memory by default before broad web and sub-agent research.

Install only if you are comfortable with a research skill that may consult prior agent memory as part of its workflow. Before using it on sensitive, proprietary, legal, medical, or personal topics, require memory-disabled operation or explicit approval for exactly which memory records may be used.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:433

Finding

Unnecessary Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33 and 433–445
Vulnerability Type: Least-privilege violation through unnecessary persistent-memory access
Risk Level: Medium

Vulnerable Code

markdown

| `memory_search` / `memory_get` | Cross-reference prior knowledge | Check MEMORY.md for related context |

markdown

### Memory Search Integration

Before starting research, check for relevant prior knowledge:

→ memory_search(query="previous research on [topic]")
→ memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]

Use prior findings to:
- Avoid duplicate research
- Build on previous conclusions
- Identify how understanding has evolved
- Note persistent gaps from prior research

Technical Analysis

The Skill directs the agent to search and retrieve persistent memory before conducting web research. Access to prior-session memory is not required for the declared core function of researching public sources and producing an academic report. This therefore exceeds the minimum privileges needed for the task.

Persistent memory may contain information from unrelated conversations, including personal data, confidential research, proprietary organizational details, or other sensitive context. The instructions provide no explicit user-consent requirement, project or namespace restriction, sensitivity filtering, data-minimization rule, or prohibition against transferring retrieved information into network queries, delegated sub-agent prompts, or generated reports.

The Skill also mandates network-enabled tools such as web_search and web_fetch and permits context to be passed to sessions_spawn. Although no instruction explicitly requires exfiltration, combining broad memory access with these communication channels creates a plausible route for unintended cross-session disclosure.

Attack Path

1. A user invokes the Skill for a topic that overlaps with sensitive material stored during an earlier session.
2. T ...[truncated 1508 chars]

Remediation

View remediation

Remediation Suggestions

Remove persistent-memory access from the default research workflow. Public-source research should operate without reading prior conversational state unless the user explicitly requests that behavior.

If memory integration is retained, implement the following controls:

1. Require informed, explicit user approval before every memory search.
2. Display the proposed search scope and explain that prior-session information may be retrieved.
3. Restrict access to a user-selected project namespace, file, or date range instead of searching all available memory.
4. Retrieve only the minimum excerpts required for the approved task.
5. Apply sensitivity detection and redact credentials, personal data, proprietary identifiers, and confidential content.
6. Never include memory-derived information in web_search, web_fetch, or sessions_spawn inputs without a separate disclosure confirmation.
7. Clearly label memory-derived content in the final report and permit the user to exclude it.
8. Record an auditable consent and access trail without storing the sensitive content itself.
9. Provide a memory-disabled mode as the default and document that disabling memory does not impair the core research workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises invocation via very broad natural-language phrases such as asking for "deep research on..." or "exhaustive analysis of...", which can overlap with ordinary user conversation and unintentionally trigger the skill. In an agent environment, ambiguous triggers increase the risk of accidental activation, unexpected tool use, and execution of a heavyweight research workflow without clear user intent or scoped approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description emphasizes rigor and native tools but does not clearly warn that the skill performs broad web searches, deep page fetches, parallel sub-agent research, and may consult memory context. This omission undermines informed consent and increases privacy and data-governance risk, especially if users provide sensitive topics assuming the skill is a simple local reasoning workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance includes broad phrases such as requests equivalent to 'tell me everything about X' and general 'deep research' wording, which can cause the skill to activate for ordinary conversations far outside a narrowly intended scope. Because this skill is designed to perform extensive web research, access prior memory context, and potentially spawn parallel sessions, accidental invocation increases the chance of unnecessary data access, unexpected external requests, and user surprise.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The workflow explicitly labels Phase 3 as 'Auto-Execute' and then proceeds with multiple tool-driven research cycles without an intervening approval gate. In an agent setting, this can cause the system to autonomously perform external searches and fetches based on an interpreted user request, increasing the risk of unbounded external interaction, accidental retrieval of sensitive content, or costly actions without explicit user confirmation.

Content

Scanner excerpt · example.md (reported line 76)May include surrounding context.

md

---

## Phase 3: Research Cycles (Auto-Execute)

### Theme 1: Market Landscape — Cycle 1

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation trigger is broad enough that ordinary phrases like "deep research" or "exhaustive analysis" could activate the skill outside a clearly intended context. In an automated or multi-skill environment, this can cause unbounded research behavior, unnecessary tool usage, and accidental handling of sensitive or irrelevant topics without explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.