DeepSeek Web Query

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:13 PM UTC
• Version: 1.0.0

Overview

The skill is meant to query DeepSeek, but it needs Review because it can reconfigure browser tooling with an unpinned package and may expose clipboard or logged-in session content.

Review before installing. Use it only if you are comfortable sending prompts to DeepSeek through a logged-in browser session. Avoid sensitive clipboard contents while it runs, and prefer a version that pins the MCP dependency, avoids clipboard reads, scopes extraction to the latest answer, and asks before replacing existing MCP configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:82

Finding

Unpinned Runtime Dependency Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-87
Vulnerability Type: Supply-chain risk caused by executing an unpinned package
Risk Level: High

Vulnerable Code

bash

# Remove the old configuration, if present
mcporter server remove chrome-devtools

# Add a new MCP server configuration
mcporter server add chrome-devtools \
  --command "npx" \
  --args "chrome-devtools-mcp@latest,--browserUrl,http://127.0.0.1:18800,--no-usage-statistics"

Technical Analysis

The documented automatic recovery process configures mcporter to run chrome-devtools-mcp@latest through npx. The latest tag is mutable, so the code executed at runtime may differ from the version that existed when this Skill was reviewed.

Package execution through npx can download and run third-party JavaScript, including package lifecycle or startup code. Consequently, compromise of the package, its publisher account, the package registry, or a transitive dependency could introduce arbitrary code into the Agent environment without any corresponding modification to this repository.

The process also removes the existing chrome-devtools server configuration before installing its replacement. This can overwrite a previously trusted or locally pinned configuration and makes the dependency-retrieval step part of an automated recovery path.

Attack Path

1. An attacker compromises the upstream package, its publisher account, the package registry, or a transitive dependency.
2. A malicious package version is published under the mutable latest distribution tag.
3. The Chrome DevTools MCP service becomes unavailable or the documented recovery process is otherwise initiated.
4. The existing chrome-devtools configuration is removed.
5. npx resolves chrome-devtools-mcp@latest and downloads the attacker-controlled release.
6. The package executes with the same operating-system identity and privileges as the Ag ...[truncated 744 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace chrome-devtools-mcp@latest with an exact, reviewed version, such as chrome-devtools-mcp@X.Y.Z.
2. Pin and verify the package integrity hash or use a lockfile-backed, reproducible installation.
3. Install the dependency during a controlled provisioning step rather than downloading executable code during runtime recovery.
4. Require explicit user confirmation before replacing an existing MCP server configuration.
5. Back up the previous configuration and restore it automatically if validation of the replacement fails.
6. Restrict registry sources to an approved registry and validate package provenance or signatures where supported.
7. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem and network access.
8. Avoid exposing authenticated browser sessions to MCP components that have not been version-pinned and reviewed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deepseek_query.py:229

Finding

Unverified Clipboard Content May Be Returned as the DeepSeek Response

Content

View full analysis

Vulnerability Details

File Location: scripts/deepseek_query.py, lines 229-252
Vulnerability Type: Unvalidated clipboard access and potential sensitive-data disclosure
Risk Level: Medium

Vulnerable Code

python

if copy_buttons:
    last_copy_button = copy_buttons[-1]
    last_copy_button.click()
    print("📋 已点击拷贝按钮，Markdown 内容已复制到剪贴板")

    # 从剪贴板获取内容
    page.wait_for_timeout(1000)  # 等待复制完成

    # 使用 evaluate 获取剪贴板内容
    clipboard_content = page.evaluate("""
        async () => {
            try {
                return await navigator.clipboard.readText();
            } catch (err) {
                console.error('读取剪贴板失败:', err);
                return null;
            }
        }
    """)

    if clipboard_content:
        result['answer'] = clipboard_content.strip()
        result['success'] = True

Technical Analysis

The script selects the last element matching a broad copy-button selector, clicks it, and then reads the browser clipboard. It assumes that the click successfully replaced the clipboard with the latest assistant response, but it does not verify that a clipboard-write event occurred or that the resulting text corresponds to the expected response element.

A click can fail to update the clipboard without raising an exception because of page changes, browser permission behavior, selector mismatch, disabled UI controls, or malicious page content. If the clipboard remains unchanged, navigator.clipboard.readText() can return pre-existing clipboard data. Any nonempty value is accepted as a valid DeepSeek answer and subsequently printed both as normal output and as part of the JSON result.

The broad selector can also match a copy control unrelated to the latest assistant response:

css

button[title*="复制"],
button[title*="Copy"],
button[class*="copy"],
button:has(svg[class*="copy"])

This increases the chance that the selected elemen ...[truncated 1484 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not use the system or browser clipboard as the primary response-extraction channel.
2. Scope extraction to the latest assistant-message container and read its inner_text, text_content, or safely serialized Markdown representation directly.
3. If clipboard access must be retained, first store or clear the existing clipboard value and require a verified clipboard change after the click.
4. Confirm an explicit copy-success notification or clipboard-write event before accepting clipboard content.
5. Bind the copy control to the latest assistant-message container instead of selecting the last button from the entire page.
6. Validate that the extracted value corresponds to the expected response, for example by comparing it with visible text from the scoped response container.
7. If validation fails, use direct DOM extraction rather than returning the existing clipboard value.
8. Avoid printing unverified clipboard content to terminal output, JSON output, or persistent logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

整体目标与声明部分一致：确实是在自动化访问 DeepSeek 网页版进行查询。但存在多处关键实现层面的描述不一致，且这些不只是普通实现细节。声明强调通过 Chrome DevTools MCP 控制浏览器，而代码完全基于 Playwright；声明称保持浏览器会话复用，但代码每次都 launch 新浏览器和新 context，虽然写入了状态文件且注释称不关闭浏览器，但在 with sync_playwright() 作用域结束后并不能构成可靠的会话复用。代码还定义了 AUTH_FILE/load_auth_state，却根本没有将认证状态加载到 context 中，因此“自动检测登录状态并提示用户”只做到检测页面上是否出现输入框并提示登录，未实现宣称的登录状态管理能力。最后，声明说使用 evaluate_script 提取 Markdown 内容直接返回，而代码实际优先点击复制按钮后读取剪贴板，evaluate 仅用于读 clipboard，不是直接从页面脚本提取 Markdown。故应判定为存在描述与行为不匹配。

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are very broad and include common phrases like '搜索一下' and '联网搜索', which can cause the skill to activate unexpectedly. In a skill that drives a logged-in browser session and returns raw page content, over-triggering increases the chance of unintended external queries, session misuse, or disclosure of unrelated data.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'When to Use' list lacks boundaries and negative cases, so the skill may be invoked for generic requests that do not require external browsing. Because this skill controls a persistent browser session and interacts with a third-party account, accidental invocation can expose user queries or retrieve content from the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly describes clicking a copy button, reading clipboard contents, and directly outputting the copied Markdown without sanitization or warning. In a browser-automation skill, clipboard access can expose unrelated sensitive data if the expected copy action fails or if the clipboard contains secrets from prior user activity, and raw passthrough output can propagate prompt-injection text, credentials, or personal data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

整个技能的触发词、界面识别文本和操作说明均默认绑定中文短语与中文界面元素，如“联网搜索”“发送消息”“深度思考”等，但未说明是否支持其他语言环境，也未给予用户语言/locale 选择。这会构成语言/locale 约束上的自然语言策略问题。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs returning raw extracted page content without filtering or summarization. In a logged-in browser context, that can disclose sensitive material from the page, including account-specific chat content, copied text, hidden page sections, or residual conversation data that was not intended for the current requester.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill intentionally keeps the browser session open for reuse, while also using broad page-text extraction. That combination materially increases cross-request data leakage risk: later users or later prompts could receive remnants of earlier prompts, responses, or account data from the same persistent DeepSeek session.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs use of npx chrome-devtools-mcp@latest, which fetches whatever version is current at execution time. This creates a supply-chain risk: a compromised upstream release or breaking update could change behavior, execute malicious code, or weaken security controls in an environment that can access a live browser session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends the user's query to a third-party website without an explicit warning or consent check at the point of transmission. In this skill's context, users may provide sensitive prompts, code, or internal data, so silent network disclosure to DeepSeek creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code clicks a page copy button and then reads from navigator.clipboard.readText(), which can return whatever is currently in the browser clipboard, not a value cryptographically bound to the DeepSeek response. In a skill context, this can expose unrelated sensitive clipboard data such as passwords, tokens, keys, or private user content, exceeding the declared behavior of merely querying DeepSeek and returning its answer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Reading clipboard contents without an explicit warning or consent is dangerous because the clipboard may contain unrelated sensitive data copied by the user or another app. In this skill, the clipboard access is not necessary to satisfy the advertised functionality and materially increases the chance of privacy leakage beyond the queried DeepSeek response.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The helper instructs the browser automation to click a copy button to place DeepSeek response content onto the system clipboard without any user-facing disclosure or consent step. Clipboard contents are globally accessible to the local user session and can overwrite sensitive clipboard data or expose copied model output to other applications, which is a real privacy and data-handling risk in an automation skill that processes arbitrary prompts and responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

All user-facing documentation and invocation examples are presented in Chinese, including the required input example, with no indication that other languages are supported or that Chinese is a justified regional constraint. This can constitute a language/locale policy issue when the skill implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The inline comments and prints state that the browser will remain open for later reuse and is intentionally not closed. However, the browser is created inside a with sync_playwright() context manager, so exiting the block will terminate Playwright-managed browser resources regardless of the commented-out browser.close(). This is an active contradiction between intent documentation and actual lifecycle behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The login guidance string specifically instructs the user to complete login via Chinese-language methods such as 手机号, 验证码, or 微信扫码, and the selectors/UX messaging throughout the file are tailored to Chinese UI text. There is no indication that the user can choose another language or that the locale restriction is documented as an intentional region-specific constraint.

Content

No source excerpt is available for this finding.