deep-research

SUSPICIOUS: the stated purpose is coherent for a research skill, but its footprint is broad. The main risk is indirect prompt injection from large volumes of untrusted web content combined with local file access, report writing, and command execution. No clear credential harvesting, covert behavior, known exfiltration endpoint, or malicious pre-execution directive is present.