deep-research (Gemini) — agentic threat model

Utilizes Gemini as its underlying foundation model. Primary threats include prompt injection during the web-reading phase, which could hijack the research plan, and potential generation of mis-aligned or biased synthesis reports.

Performs dynamic data operations by searching and reading external web sources. Highly vulnerable to indirect prompt injection and knowledge-base poisoning from malicious web pages ingested during the autonomous search loop.

Implements an autonomous plan-search-read-synthesize loop. Threats include tool misuse (e.g., SSRF via the search/read tools) and planning manipulation where an attacker-controlled page redirects the agent's research goals.

Not certain from the listing — The deployment environment is not specified. If run locally or in an unsandboxed container, the search/read tools could be abused to scan internal network ranges or access local metadata services.

Features basic risk-tagged frontmatter marking the skill as 'safe' and citing its source. However, there is no evidence of real-time run-time guardrails, semantic validation of synthesized reports, or anomaly detection for the search loop.

Not certain from the listing — No explicit compliance frameworks, identity management, or authorization policies are detailed. Access control to the search tools and output directories remains unspecified.

Designed as an 'Agent Skill' to drive report generation from a parent agent. Threats include cascading failures if the parent agent implicitly trusts the risk-tagged frontmatter without independent verification.