DeepSeek Harness PaddleOCR GUI Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.1

Overview

This setup skill is coherent but asks users to run unpinned remote installation commands whose effective code can change after review.

Install only if you trust the DSH npm package and the referenced GitHub repository at the time you run it. Prefer a pinned package version and an immutable commit SHA, review the plugin source first, and provide OCR credentials only through the intended credential field in an isolated environment with minimum needed file access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:28

Finding

Unpinned Remote Dependencies Permit Post-Review Code Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-34
Vulnerability Type: Unpinned remote payload retrieval and supply-chain risk
Risk Level: High

The Skill directs users to download and execute an unpinned npm package and install a plugin from the mutable main branch of a personal GitHub repository:

bash

npx @deepseek-ai/dsh plugin --profile web add "github:Aidenwu0209/dsh-PaddleOCR-Skills#main"
npx @deepseek-ai/dsh web

Technical Analysis

npx @deepseek-ai/dsh does not specify an exact package version or integrity value. Depending on the local environment, npx can retrieve and execute the package currently published under that name.

The plugin source is similarly referenced through #main, which is a mutable Git branch rather than an immutable, reviewed commit. The effective code installed by these instructions can therefore change after this Skill has been audited. The downloaded DSH package and plugin implementation are not present in the audited project, so their behavior cannot be validated from the available files.

This creates both a remote payload retrieval risk and an insecure dependency risk. Compromise of the npm package, GitHub account, repository, branch, maintainer credentials, or publication process could substitute malicious code without requiring any modification to this Skill.

Attack Path

1. An attacker compromises the npm package publication process, the referenced GitHub account, or its repository.
2. The attacker publishes a malicious package version or pushes malicious plugin code to the mutable main branch.
3. A user follows the Skill and runs the documented npx installation command.
4. npx retrieves and executes the current package, which then retrieves the current plugin content from GitHub.
5. The substituted code executes with the privileges of the user running DSH.
6. Malicious code could access data available to that user or interfere with ...[truncated 768 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @deepseek-ai/dsh to a specific, audited version rather than allowing npx to resolve the current release.
2. Replace the mutable #main reference with a full, audited Git commit SHA.
3. Publish and verify cryptographic integrity hashes or signed release attestations before installation.
4. Prefer an official, controlled release artifact over installation directly from a personal repository branch.
5. Review the exact DSH package and plugin source corresponding to the pinned versions before recommending execution.
6. Run installation and the web service with least privilege in an isolated environment, without unnecessary filesystem access or credentials.
7. Grant credentials only after installation integrity and plugin behavior have been verified, and constrain tokens to the minimum permissions required.
8. Document an update process that requires security review before changing either pinned version or commit.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to execute npx @deepseek-ai/dsh plugin --profile web add ... without pinning @deepseek-ai/dsh to a specific version. Because npx resolves and may download the latest package at execution time, a compromised upstream release or breaking update could cause users to run unexpected code during installation. In a setup skill that directly tells users to run shell commands, this context makes the risk more concrete rather than theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command npx @deepseek-ai/dsh web also invokes an unpinned package version, creating a supply-chain risk where execution behavior can change or be hijacked by a malicious or compromised release. Since this skill is specifically a guided install-and-launch workflow, users are likely to copy-paste the command verbatim, increasing the chance of exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.