ClawHub
Back to skill

Security audit

DeepSeep Intergration

Security checks for vulnerabilities and agentic risk

Overview

This is a small DeepSeek tool stub with no evidence of hidden, persistent, destructive, or data-exfiltrating behavior, though users should know it is not a real API implementation yet.

Install only if you are comfortable with a currently nonfunctional/stub DeepSeek tool. Before using any future version that actually calls DeepSeek, confirm what prompt data will be sent externally and avoid sending secrets, private code, credentials, or regulated data unless your organization allows it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · tools/deepseek.js (reported line 7)May include surrounding context.

js
const { Tool } = require('openclaw-sdk');

module.exports = class DeepSeekTool extends Tool {
  constructor() {
    super({
      name: 'deepseek',
      description: 'Call DeepSeek API for chat completions',
      parameters: {
        type: 'object',
        properties: {
          prompt: {
            type: 'string',
            description: 'The prompt to send to DeepSeek'
          }
        },
        required: ['prompt']
      }
    });
  }

  async execute({ prompt }, context) {
    try {
      // Hier kommt später die DeepSeek API Integration
      return {
        success: true,
        message: `DeepSeek would process: ${prompt}`,
        data: { prompt }
      };
    } catch (error) {
      return {
        success: false,

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill’s usage description is very broad, allowing the agent to invoke an external LLM for open-ended tasks such as code generation, planning, and problem solving without any stated trigger constraints, approval requirements, or scope limits. In an agent setting, this increases the chance of unintended data sharing, unsafe autonomous behavior, and misuse of generated output because the model can be consulted in many contexts without guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill requires a sensitive API key and describes use of an external API, but it does not warn users that prompts, code, or other agent data may be transmitted to a third-party service. This omission can lead operators to expose confidential information or regulated data to an external provider without informed consent or appropriate controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The tool metadata says 'Call DeepSeek API for chat completions', which describes real API-backed behavior. However, the execute method contains a placeholder comment and simply returns 'DeepSeek would process' with the original prompt, so the documented intent contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.