Skills/ClawHub/research-pro

research-pro@3.17.2

CAUTION· install only

Publisher claims: "系统化研究 skill — 螺旋收敛模型。把任何问题（模糊或清晰）分解成子问题，迭代搜索，越搜越清晰，直到每个子问题都有答案。 Triggers: "帮我研究", "研究一下", "调研", "分析对比", "research", "investigate", "look up" 也触发: 竞品分析、市场调研、技术选型对比、趋势了解 Setup triggers: "安装 research-pro", "配置 research-pro", "research-pro doctor", "setup research-pro", "research-pro 未就绪" **Gates:** 开始外部搜索前必须通过 READY doctor 与 Search Target Confirmation Gate；所有交互式多源/外部研究必须先展示 Search Contract 并收到用户明确确认。唯一例外是一个用户明确提供的 URL/文件、且只要求读取/提取/摘要、不作跨源比较或推断的 `NARROW_SELFCHECK`（见 SKILL Phase 1）。 Does NOT trigger normal multi-source research: - 已经知道答案的简单事实问题 - 用户直接给了 URL/文件、且只要读取/提取/摘要的，按 Step 1.2 的 `NARROW_SELFCHECK` 处理（不进入跨源 research） - 代码调试、写代码任务 Output: 结构化研究报告（结论 + 子问题答案 + 来源 + 争议点 + 未解决缺口）" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher mfang0126 · publishing for 76 daysInstalls 378Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-08 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.1sfilesystemread ~/.config/research-pro/.env.example outside project
0.1sfilesystemwrote ~/.config/research-pro/.env.example
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexec /usr/bin/ln
0.1sprocessexec /usr/bin/chmod
0.1sprocessexec /usr/bin/cp
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.4sfilesystemread ~/.hermes/external-skills/research-pro · ~/.openclaw/skills/research-pro · ~/.codex/skills/research-pro · ~/.config/research-pro/.env.example outside project
0.4sfilesystemwrote ~/.config/research-pro/.env.example
0.4sprocessexec /usr/bin/faketime
0.4sprocessexec /usr/bin/dirname
0.4sprocessexec /usr/bin/mkdir
0.4sprocessexec /usr/bin/ln
0.4sprocessexec /usr/bin/chmod
0.4sprocessexec /usr/bin/cp

Static findings

HIGH
Access to sensitive file pathsSKILL.md:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files**禁止：** 为检查配置而 `cat` / 打印 `.env` 内容。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files**⚠️ 裸第三方 CLI 必经 shim：** `tvly`/`firecrawl`/`youtube_transcript_api` 等只读 `process.env`，不会自动加载 `.env` 源 → 冷启动报 "No API key"。**必须**用 `node {baseDir}/scripts/run-with-creds.mjs <cmd> ...` 运行（进程内注水 env 再 Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files**凭据：** `scripts/lib/credentials.mjs`（never-override + allowlist）。通用 `~/.config/research-pro/.env`（`env.example`）。安全：`references/security.md`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/doctor.mjs:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 编辑 ${home}/.env ，填入任意一个:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/doctor.mjs:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp "${baseDir}/env.example" "${home}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/doctor.mjs:63 · File permission modification command — agent changes file ownership/permissionsmkdir -p "${home}" && chmod 700 "${home}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/lib/credentials.mjs:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* $RESEARCH_PRO_HOME/.env (default ~/.config/research-pro/.env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileschmod 600 ~/.config/research-pro/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " cp $CFG/.env.example $CFG/.env && chmod 600 $CFG/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/run-with-creds.mjs:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* their keys from process.env, but nothing hydrates their env — the .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [[ ! -f "$CFG/.env" ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib/credentials.mjs:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Hermes: ~/.hermes/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsevals/validate_contract_gate.mjs:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.match(skill, /打印 `\.env` \/ secret 值/, "no-secrets rule must remain");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp {baseDir}/env.example ~/.config/research-pro/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/doctor.mjs:145 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconsole.log(" (none — export keys or create ~/.config/research-pro/.env)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp "$ROOT/env.example" "$CFG/.env.example"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib/credentials.mjs:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* OpenClaw: ~/.openclaw/.env + openclaw.json env / skills.entriesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandSKILL.md:106 · File permission modification command — agent changes file ownership/permissionsmkdir -p ~/.config/research-pro && chmod 700 ~/.config/research-proFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandSKILL.md:109 · File permission modification command — agent changes file ownership/permissionschmod 600 ~/.config/research-pro/.envFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/doctor.mjs:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 再编辑 ~/.config/research-pro/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/run-with-creds.mjs:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* sources (~/.hermes/.env, ~/.openclaw/.env, ~/.config/research-pro/.env) areFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/doctor.mjs:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileschmod 600 "${home}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/lib/credentials.mjs:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* ~/.config/research-pro/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/install.sh:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " wrote $CFG/.env.example — copy to .env and add keys:"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/doctor.mjs:69 · File permission modification command — agent changes file ownership/permissionschmod 600 "${home}/.env"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install.sh:46 · File permission modification command — agent changes file ownership/permissionschmod 700 "$CFG" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install.sh:51 · File permission modification command — agent changes file ownership/permissionsecho " cp $CFG/.env.example $CFG/.env && chmod 600 $CFG/.env"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionscripts/reddit-cli.js:249 · File type combined with upload action — agent may exfiltrate local data filesposts.forEach((p, i) => console.log(formatPost(p, i + 1)));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/reddit-cli.js:223 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`📮 r/${subreddit} - ${sort} posts\n${'─'.repeat(50)}\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/reddit-cli.js:225 · File type combined with upload action — agent may exfiltrate local data filesposts.forEach((p, i) => console.log(formatPost(p, i + 1)));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/reddit-cli.js:282 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`📮 r/${post.subreddit}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/reddit-cli.js:283 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n${post.title}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/host_native_trace.py:147 · Python subprocess execution detectedcompleted = subprocess.run(cmd, capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈7,368 tok
1 file · 40 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/research-pro/.env.example, ~/.config/research-pro/.env.example.
  2. Unclaimed publisher≈ +8 on the totalClaim mfang0126: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mfang0126Propose a patch to the maintainer