deep-research

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill contains explicit, non-user-visible operational instructions to autonomously publish generated reports (including local filesystem commands and a default opt-out trigger), which goes beyond simply producing research content and can exfiltrate outputs without clear user consent.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repo contains an explicit, mandatory auto-publish instruction that will upload reports to an external LovStudio blog by default (unless the user opts out), combined with code that performs outbound DOI/URL checks and continuation-state cleanup — together these are intentional behaviors that create a high risk of unintended data exfiltration or exposure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested via the runtime web retrieval path (Phase 3 “RETRIEVE” uses search-cli/WebSearch and page extraction/scraping, then the extracted page text is used as evidence and fed back into later LLM generation), which can include prompt-injection content from arbitrary public web pages.