Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Deep Research Pro v2

v2.0.0

提供完整多阶段深度研究,覆盖规划、跨源检索、质量筛选、深入分析、交叉验证及结构化报告生成。

0· 133·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (deep multi‑source research) align with the files and instructions: planning, multi‑source retrieval, screening, analysis, validation, and report templates are all present. No unexpected credentials, binaries, or external installers are requested. Minor coherence issue: different files use different quality-score scales (QUALITY_CRITERIA and templates reference a 0-1.0/percentage-style score while scripts/quality-score.py computes a 0-10 total), which is likely a logic/normalization bug rather than malicious behavior.
Instruction Scope
SKILL.md describes a bounded 7‑phase research pipeline and references legitimate public sources (OpenAlex, PubMed, Google Scholar) and local processing (Python/jq/bc alternatives). The instructions do not ask the agent to read unrelated system files or environment variables, nor to post results to unknown endpoints. The skill states it auto-activates when a user requests deep research — that is consistent with its purpose and agent invocation defaults.
Install Mechanism
No install spec; the skill is instruction-only with one small included Python script. Nothing is downloaded from external/unknown URLs, no archives are extracted, and no package installs are declared.
Credentials
The skill requests no environment variables, no credentials, and no config paths. It references OpenAlex and other public sources but does not require keys in the manifest. This is proportionate to its stated function.
Persistence & Privilege
always:false and normal model invocation settings (disable-model-invocation:false). The skill does not request persistent privileges or modify system/global skill configurations. Autonomous invocation is allowed by default and appropriate for this type of skill.
What to consider before installing
This skill appears to implement a reasonable multi‑phase research workflow and includes a small Python scoring script and report templates, but you should do the following before installing or relying on it: - Verify scoring consistency: the included QUALITY_CRITERIA and templates use a 0–1.0 or normalized quality scale, while scripts/quality-score.py computes totals on a 0–10 scale. Confirm how scores are normalized in the final report to avoid misleading grades. - Ensure runtime environment: the script expects Python3 and that the agent environment can read/write the described report directory structure and JSON source files. Test the script locally with sample source JSON to verify behavior. - Review web access implications: the skill will fetch many external sources (OpenAlex, PubMed, Google Scholar, company sites). Make sure the agent is allowed to make outbound web requests, and be aware of rate limits, robots.txt and copyright considerations (Google Scholar may require manual scraping or special handling). - Validate data handling: because the skill aggregates many sources and generates reports, check that no sensitive/internal documents will be pulled or published inadvertently when run in an environment with access to private intranets or proprietary APIs. - Test with non‑sensitive topics first: run the pipeline on public topics to confirm outputs (source lists, filtered/ excluded reasoning, final report) and that references/links are correctly formatted and accessible. Overall: coherent and low technical risk, but the scoring/template mismatch and heavy sourcing requirements merit review/testing before trusting outputs for decision making.

Like a lobster shell, security has layers — review code before you run it.

deepvk97dznf928zkgechceyq683e69837bktlatestvk97dznf928zkgechceyq683e69837bktresearchvk97dznf928zkgechceyq683e69837bktstudyvk97dznf928zkgechceyq683e69837bkt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments