assafelovic/gpt-researcher skill
research agent
GPT Researcher is an open-source agent that conducts deep research on any topic using web sources and local documents, then generates detailed, cited reports. It uses a planner-and-executor architecture to ask research questions, gather information from multiple sources, and synthesize findings into comprehensive reports of 2,000+ words.
Generate objective research reports on topics when manual research would be time-intensive Combine web search with local document analysis for domain-specific research tasks Embed AI-generated illustrations in reports using Google Gemini for visual context Export research findings to PDF, Word, and other formats for sharing Integrate with Claude or other AI applications via MCP for conversational research 9 HIGH✓ 9 MEDIUM 19 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 9 likely real (100%) 1 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 3 high-signal, 1 mostly false-positive (hidden by default)
CHK-083 4 findings 4 likely
0% FP CHK-099 3 findings 3 likely
0% FP CHK-090 2 findings 2 likely
0% FP ▼ Show 1 checker that are mostly false positives (1 findings) 37 findings click to expand
CHK-083 Potential path traversal — user-controlled path in file operation: multi_agents/main.py
multi_agents/main.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: backend/server/app.py
backend/server/app.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: multi_agents_ag2/main.py
multi_agents_ag2/main.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: backend/server/server_utils.py
backend/server/server_utils.py
AI: likely real possible ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
backend/run_server.py
AI: likely real likely ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
main.py
AI: likely real likely ▼
CHK-099 Potential IDOR — 'thread_id' accessed without ownership check
multi_agents/agents/orchestrator.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'thread_id' accessed without ownership check
frontend/nextjs/components/Langgraph/Langgraph.js
AI: likely real possible ▼
CHK-099 Potential IDOR — 'document_id' accessed without ownership check
gpt_researcher/prompts.py
AI: likely real possible ▼
CHK-125b chmod — permission modification — no scope constraint in Dockerfile
Dockerfile
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in simple_evals/run_eval.py
evals/simple_evals/run_eval.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scraper/scraper.py
gpt_researcher/scraper/scraper.py
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in document/online_document.py
gpt_researcher/document/online_document.py
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in pymupdf/pymupdf.py
gpt_researcher/scraper/pymupdf/pymupdf.py
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in browser/browser.py
gpt_researcher/scraper/browser/browser.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in generic/base.py
gpt_researcher/llm_provider/generic/base.py
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in server/server_utils.py
backend/server/server_utils.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/docker-build.yml
.github/workflows/docker-build.yml
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in tavily/tavily_search.py
gpt_researcher/retrievers/tavily/tavily_search.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in custom/custom.py
gpt_researcher/retrievers/custom/custom.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in bocha/bocha.py
gpt_researcher/retrievers/bocha/bocha.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in image/modelslab_image_generator.py
gpt_researcher/llm_provider/image/modelslab_image_generator.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in google/google.py
gpt_researcher/retrievers/google/google.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in crw/crw.py
gpt_researcher/retrievers/crw/crw.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in pymupdf/pymupdf.py
gpt_researcher/scraper/pymupdf/pymupdf.py
possible ▼
CHK-025 Hardcoded endpoint in skill: https://skills.sh/assafelovic/gpt-researcher/gpt-researcher
docs/docs/gpt-researcher/gptr/claude-skill.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://docs.gptr.dev
docs/docs/gpt-researcher/gptr/claude-skill.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in xquik/xquik.py
gpt_researcher/retrievers/xquik/xquik.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in openalex/openalex.py
gpt_researcher/retrievers/openalex/openalex.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in brave/brave.py
gpt_researcher/retrievers/brave/brave.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in searchapi/searchapi.py
gpt_researcher/retrievers/searchapi/searchapi.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in semantic_scholar/semantic_scholar.py
gpt_researcher/retrievers/semantic_scholar/semantic_scholar.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in searx/searx.py
gpt_researcher/retrievers/searx/searx.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in bing/bing.py
gpt_researcher/retrievers/bing/bing.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in pubmed_central/pubmed_central.py
gpt_researcher/retrievers/pubmed_central/pubmed_central.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in groundroute/groundroute.py
gpt_researcher/retrievers/groundroute/groundroute.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in serpapi/serpapi.py
gpt_researcher/retrievers/serpapi/serpapi.py
possible ▼
▼ Show 1 false positive (3% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.