deep-research

SUSPICIOUS. The overall workflow matches a research/report skill, but the footprint is broader than necessary: it auto-installs and registers an external MCP tool with weak provenance evidence, modifies agent configuration, and combines untrusted web ingestion with write/exec capabilities. No confirmed credential theft or covert exfiltration is shown, but the supply-chain and indirect prompt-injection risks are material.

This module is primarily a report viewer/exporter, but it contains a high-impact client-side HTML injection sink: PB.innerHTML = marked.parse(m), where m comes from a global report content object RD[k] (origin not shown). If RD content is not guaranteed safe or marked allows/does not sanitize raw HTML, the code can enable DOM XSS. Separately, the module dynamically injects essential third-party scripts at runtime without integrity/pinning controls, creating a supply-chain/code integrity risk if those assets can be tampered with. No direct malware behaviors (exfiltration, credential theft, reverse shells) are evident in the provided fragment.