T09 · Insecure Skill Coding Practices
Warning
- Location
strategies/search-protocol.md:77- Finding
Untrusted Web Content Is Processed Without Prompt-Injection Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Deep Researcher
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed web-research skill that saves local Markdown reports, with privacy and prompt-injection cautions users should understand before use.
Install only if you are comfortable with research topics being sent to your configured search provider and result pages being fetched. Do not paste secrets, private customer data, unreleased plans, or internal incident details into research prompts. Review the inferred save path before relying on generated files, and treat conclusions from fetched web pages as research output rather than trusted instructions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:452- Finding
Potentially Sensitive Research Queries Are Automatically Sent to External Providers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill declares it is triggered automatically whenever a user expresses research intent in natural language, which is broad enough to activate on ordinary conversations that merely mention analysis or comparison. Because the skill is permitted to use WebSearch and Write, unintended activation can cause unsolicited external queries and file creation without a clearly scoped user command, increasing the risk of data leakage and unexpected side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file describes automatic domain-region detection and searching in the 'official local language,' plus fallback language inference, but does not mention giving the user a language choice or requiring opt-in. This can violate language/locale policy by forcing locale behavior based on inference rather than explicit user preference.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog states that the skill performs 'Automatic mode detection from natural language' and that 'No flags or explicit commands' are required. For a markdown file, this describes activation behavior in a broad way without specifying concrete trigger phrases, constraints, or exclusion cases, which could lead to unintended invocation from ordinary requests.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Copy skill files into your agent's skills directory # (adjust path to match your platform) mkdir -p ~/.your-agent/skills/deep-researcher cp -R SKILL.md references/ strategies/ templates/ ~/.your-agent/skills/deep-researcher/
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says the skill is triggered automatically when the AI recognizes 'research intent' and that it infers subjects, region, language, and output path from meaning, but it does not define clear activation boundaries. In an agent environment, overly broad auto-trigger semantics can cause the skill to activate on unintended prompts and initiate web research or downstream actions without explicit user confirmation, increasing the risk of prompt hijacking, unexpected network access, or accidental processing of sensitive topics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states the skill infers 'where to save the output' and even shows an explicit save-path example, but it does not warn users that output files may be written automatically based on inferred intent. In an agent setting, silent or inferred file writes can overwrite existing notes, create files in sensitive locations, or leak researched content into persistent storage without the user's informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions mandate that ambiguous queries such as a single technical term default to Chinese output. This forces a specific language choice in cases where user preference is unknown, which is a natural-language locale policy violation under the stated rules.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill chooses a default save location of
context/[domain].mdwhen the user does not specify a path, but the domain-to-filename mapping is not concretely defined or sanitized. In practice this can lead to surprising file creation, collisions with existing files, or writes to unintended filenames derived from ambiguous or adversarial query text, especially since the skill is also configured to auto-trigger.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol hard-requires inferred region-based local-language searches even when the user did not request that behavior. This can silently expand data handling to other languages and jurisdictions, causing policy misalignment, unexpected external querying, and reduced user control over where and how research is performed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The fallback rules explicitly forbid defaulting to English and require the system to infer local languages from scripts, geography, or policy context without user choice. That creates a broad, implicit autonomy surface where the skill may perform searches in languages the user did not authorize, increasing the risk of unintended data disclosure, compliance issues, or misleading results from incorrect inference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The enforcement section prevents fallback to English for required local-language searches, forcing the agent to continue attempting jurisdiction-specific queries even when results are poor or unavailable. This removes a safe operational fallback and can drive brittle or overreaching search behavior that is misaligned with user expectations and organizational policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The changelog notes that structural labels are translated for several languages in output, but it does not say that users can choose or decline localization. Without an explicit opt-in or override, this may impose a language/locale choice automatically.
- Content
Static analysis
No suspicious patterns detected.