HF Daily Deep Researcher

• Outcome: Review
• Latest audit: Aug 26, 2026 · 10:24 AM UTC
• Version: 5.2.9

Overview

This research-report skill is not clearly malicious, but it needs Review because it can import workspace profile or memory data into persistent configuration and encourages automatic Feishu upload of generated reports.

Install only if you are comfortable with the skill reading OpenClaw USER.md/MEMORY.md-style profile files when init.py is run, saving extracted research interests locally, and potentially uploading generated reports to Feishu after you configure OAuth. Keep Feishu upload disabled unless you intend third-party sharing, and review config.json before scheduled or automatic runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes capabilities to read environment data and read/write local files, but does not declare permissions up front. That creates a transparency and consent gap: users may invoke a research skill without realizing it can inspect workspace state and persist data locally. In this context the behavior is somewhat expected for report generation, but undeclared access still increases privacy and abuse risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is paper tracking and research, but the skill also states it may extract information from USER.md, MEMORY.md, memory/*.md, and environment variables to populate profiles. That is a material behavior expansion into personal/workspace data collection, which can expose sensitive notes or identity information unrelated to the task. Because the skill persists the extracted research focus for later runs, the privacy impact is amplified.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The workflow supports uploading generated reports to Feishu via plugin/OAuth, but this external transmission is not treated as a primary data-handling behavior in the skill description. Even if the content is research-oriented, reports can contain user interests, internal notes, project directions, or proprietary summaries, making silent export to a third party risky. The skill context makes this more sensitive because it aggregates content from local context and prior analysis before upload.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: Adding an exec/curl retrieval path introduces shell-command execution into a skill whose stated purpose is research aggregation. Shell execution broadens the attack surface substantially compared with constrained network-fetch tools, because command construction errors or future parameter interpolation could lead to command injection or unintended system access. Even if the current example is fixed-string usage, the capability itself is higher risk than necessary for the described task.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The prompt contains contradictory control-flow instructions: one section forbids any intermediate output, while a later timeout section explicitly requires progress reports before completion. Conflicting directives can cause the agent to leak partial reasoning, produce inconsistent behavior across model/tooling environments, or fail orchestration expectations when a controller assumes silence until final output.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The prompt explicitly instructs the agent to invoke a general shell execution capability (`exec`) to run `curl` against an external URL. Even though the example is read-only, expanding a paper-search skill to shell access increases the capability surface, creates a path for command injection if topic-derived values are later interpolated, and bypasses tighter controls that purpose-built fetch tools may enforce.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation promotes automatic Feishu upload without a clear user-facing warning that report contents will be transmitted to an external service. This is dangerous because generated reports may include sensitive research direction, internal analysis, or information derived from local files, and users may assume output remains local. The skill context increases the risk because the upload is framed as a convenience feature rather than a data-sharing action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The initialization flow says it may extract research directions from USER.md and MEMORY.md, but it does not present that as a privacy-sensitive action requiring informed consent. Those files can contain far more than topic keywords, including personal context, internal project details, and long-term memory artifacts. In a research assistant skill, this makes the issue more dangerous because the scraping is adjacent to the expected function and may go unnoticed.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The prompt content is entirely in Chinese and does not provide any language-selection mechanism, fallback, or documented locale restriction. In a multi-agent research workflow, this can cause downstream agents, reviewers, or operators who expect English or multilingual interoperability to misunderstand requirements, skip checks, or produce inconsistent outputs, reducing reliability of quality and safety review.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill is written to require Chinese-language analysis and output without any indication that this was selected by the user at runtime. This can override user preference, reduce accessibility, and cause downstream agent misalignment or incorrect handoff behavior in multilingual systems, though it does not by itself create direct code-execution or data-exfiltration risk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill content is entirely in Chinese and prescribes a fixed output format in Chinese without indicating any justified locale restriction or offering a language fallback. This can exclude users or downstream agents operating in other languages, increasing the risk of misunderstood instructions, incorrect task execution, or inaccessible outputs in multi-agent pipelines.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The keyword set is broad and heavily inference-driven, with many generic RL terms such as 'hierarchical RL', 'multi-agent RL', 'PRM', and acronym-based matches that can trigger on unrelated research. In a paper-discovery skill, this can cause over-collection, unintended activation, and topic drift, which may feed irrelevant or misleading results into downstream agents and reports.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill describes collecting research-focus data from profile/memory files and persisting it for future runs. Persistence turns a one-time privacy issue into durable data retention, increasing exposure if the workspace is shared or if later runs reuse data in unintended ways. In context, storing a user's research interests may reveal confidential strategic priorities or employer-sensitive work areas.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.