by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to implement the advertised research pipeline, but it gives the agent permission to read and write files in your home directory and to spawn recursive continuation agents that load saved state. Before installing or enabling it: 1) review the remaining code files you haven't inspected (especially research_engine.py and verify_citations.py) for network calls or any calls that read arbitrary paths; 2) consider running the skill in a sandboxed account or VM so its file writes (~...详细分析 ▾
✓ 用途与能力
Name/description align with the included files: citation manager, report validators, markdown→HTML, source evaluator, and an orchestration engine. Persisting reports and citations to disk and converting to PDF/HTML are coherent with an enterprise research skill.
⚠ 指令范围
SKILL.md explicitly instructs the agent to run shell commands (e.g., date), read and write files under ~/Documents and ~/.claude/research_output, spawn Task sub-agents that load continuation_state and report files, and 'Grep/Read for local documentation'. Those directives permit reading arbitrary local documents and recursive agent spawning; while plausible for deep research, they broaden what the agent may access and persist beyond the narrow task of web search and synthesis.
✓ 安装机制
No install spec (instruction-only) — lowest install risk. README suggests optional external tools (brew search-cli, pip install weasyprint) if the user opts in; those are optional and clearly documented.
ℹ 凭证需求
The skill declares no required env vars or credentials. However README and SKILL.md suggest optional multi-provider search-cli setup requiring provider API keys, and the skill will run network-based citation verification. The absence of declared env vars is consistent but you should not supply unrelated credentials. The skill does persist state to home directory.
⚠ 持久化与权限
The skill persists continuation_state and sources.json under ~/.claude/research_output and writes reports to ~/Documents. It also instructs spawning continuation agents (Task tool) that read/write those files recursively. 'always' is false, but the persistence and recursive agent spawning increase blast radius if misused or if underlying orchestration code performs unexpected reads or network calls.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/11
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install deep-research-bak
镜像加速npx clawhub@latest install deep-research-bak --registry https://cn.longxiaskill.com