Agent Economy ReportAgent Economy ReportCAUTION version 1.0.2 · audited 2026-09-17
This skill instructs an AI agent how to perform web research: it plans questions, searches DuckDuckGo through a separate script, fetches web pages with curl, and writes a cited Markdown report under the user's home directory. The reviewed package is mostly documentation and workflow instructions; a referenced scripts/research tool is listed in package.json but not included in the provided files. It does not request API keys or wallet access. The main risk is that it fetches and reads untrusted web content, and its curl command passes a URL through a shell in a way that the skill's own card warns could allow a malicious URL to run local shell commands. The workflow does not implement the URL validation and safe invocation advice given in its own risk disclosure, so a cautious review is warranted.
Instructions try to steer the agent beyond the declared purpose. SKILL.md line 58 tells the agent to curl arbitrary URLs, and line 68 says to read fetched pages in full. Those pages are not quarantined from the agent's instruction stream. Additionally, skill-card.md line 25 states that the documented URL-fetching command can allow a malicious URL to execute local shell commands.
| Declared purpose | Multi-source deep research agent. Searches the web, synthesizes findings, and delivers cited reports. No API keys required. |
| Observed behavior | SKILL.md tells the agent to call an external DDG search script at an absolute path, fetch pages with curl and pipe the HTML through python3 to strip tags, read 3-5 full sources, and save a report to ~/clawd/research/[slug]/report.md. It includes a sessions_spawn example for running the skill as a sub-agent. README.md documents a standalone scripts/research CLI, but that file is not among the provided package files. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | SKILL.md line 41 and line 44 run DDG search; line 58 uses curl to fetch full pages. |
| shell | needed | SKILL.md commands are bash shell commands; README.md documents a CLI tool. |
| filesystem_read | needed | SKILL.md line 142 instructs a sub-agent to read the SKILL.md file; the workflow may also invoke the external DDG script. |
| filesystem_write | needed | SKILL.md line 110 creates ~/clawd/research/[slug] and instructs writing report.md. |
| install_packages | needed | README.md line 100 says dependencies install automatically when the referenced script runs; no script was provided to verify this. |
| other | exceeds purpose | SKILL.md lines 140-149 show spawning a sub-agent; this is an agent feature, not required for the core research workflow. |
| severity | finding |
|---|---|
| high | Unsafe URL interpolation in shell fetch command This command puts a URL into a double-quoted shell argument. If the URL comes from a search result or a user-provided --fetch value and contains shell metacharacters, shell command substitution could run commands on the agent host. The package's own skill card warns about this at skill-card.md line 25. SKILL.md:58 curl -sL "<url>" | python3 -c " |
| high | Publisher discloses shell-injection risk This line confirms that the curl-based URL fetching can become local shell command execution if a malicious URL is used. The SKILL.md workflow does not include a validation step before invoking curl. skill-card.md:25 Risk: The documented URL-fetching command can allow a malicious URL to execute local shell commands. |
| medium | Untrusted fetched content is read directly The agent is instructed to read full web content from arbitrary sources. Malicious pages could include prompt-injection text designed to steer the agent away from its task or to perform unintended actions. SKILL.md:68 Read 3-5 key sources in full for depth. Don't just rely on search snippets. |
| info | Safety mitigation is advisory only The mitigation says to validate URLs and avoid shell interpolation, but the SKILL.md workflow still uses the quoted curl command and does not include validation or escaping steps. skill-card.md:27 Mitigation: Validate URLs before fetching and invoke curl without shell interpolation; avoid fetching arbitrary or untrusted URLs. |
| low | CLI can fetch user-specified URLs This documents fetching a URL supplied on the command line. Arbitrary or untrusted URLs passed to --fetch follow the risky fetch path described in SKILL.md. README.md:60 ./scripts/research --fetch "https://example.com/article" |
| low | Report is written under the user's home directory The workflow saves reports to ~/clawd/research/[slug]/report.md. This matches the stated purpose but gives the agent write access to that path. SKILL.md:110 mkdir -p ~/clawd/research/[slug] |
| low | Sub-agent spawning example The skill instructs spawning a sub-agent for research and naming it research-[slug]. If untrusted content is included in the task, it could influence the sub-agent's behavior. SKILL.md:140 sessions_spawn( |
| info | Automatic dependency installation declared The README says dependencies install automatically. Because the scripts/research file is not present in the reviewed package, this behavior cannot be verified and could involve downloading dependencies from package indexes. README.md:100 The script is self-contained — dependencies install automatically on first run. |
| info | Declared script file not present in reviewed package package.json lists scripts/research as part of the package, but the provided package files do not include scripts/research. The documented CLI behavior could not be inspected. package.json:8 "files": ["SKILL.md", "scripts/research", "package.json"] |
| low | Uses external DDG search script The skill depends on a separate ddg-search script at an absolute path. That script is outside this package and could be changed independently. The skill does not include fallback search behavior. SKILL.md:41 /home/clawdbot/clawd/skills/ddg-search/scripts/ddg "<sub-question keywords>" --max 8 |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | README.md:60 |
| github.com | not in the service index | README.md:3 |
| moltbook.com | not in the service index | README.md:108 |
| Binaries invoked | bash, curl, git, python3, uv |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 4 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
README.md | 108 | 5cfccbf491b06613… |
SKILL.md | 156 | a780f8bbec442198… |
_meta.json | 6 | 2facdc2bd00bd4ae… |
package.json | 9 | 7fa0a4ea9ec446b5… |
skill-card.md | 61 | f1aa52c261d29b40… |
For agents
JSON: https://agenteconomy.report/k/deep-research-pro.audit.json · badge: https://agenteconomy.report/k/deep-research-pro.audited.svg ·
skill rating: /k/deep-research-pro · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).