deep-research

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Both URLs are personal GitHub repositories referenced by installer scripts and npx/git commands in the skill (third‑party, non-vendor sources that can deliver and run arbitrary code), so they should be treated as potentially unsafe until the repos and their maintainers are verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the /research-deep deep pipeline, the agent reads outline.yaml to get item_related_info (including user-supplied YAML content) and then runs a prompt for each item that triggers the delegated web-search agent, which can ingest outsider-authored free text from GitHub Issues/Reddit/Stack Overflow search results and fetched pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer script (scripts/install.sh) fetches remote skill repositories at runtime—npx installs https://github.com/akillness/jeo-skills and the script can git-clone https://github.com/Weizhena/Deep-Research-skills (the latter copies upstream slash-command skills that include prompt templates), meaning fetched content can directly supply/override agent prompts and install code.