DeepSeek Chat

DeepSeek 官方 API 对话（免费/超便宜，支持中文）

Security Scan

The skill generally matches a DeepSeek chat client, but there are clear inconsistencies and a hard-coded API key in config.env — the registry metadata doesn't declare the required API key and the declared required binary (curl) doesn't match the code (node).

Purpose & Capability

The skill's stated purpose (DeepSeek chat) matches the actual behavior (scripts/chat.js calls api.deepseek.com). However the registry metadata claims no required env vars and lists curl as a required binary, while the runtime requires node and DEEPSEEK_API_KEY. These mismatches are incoherent with the stated packaging.

Instruction Scope

SKILL.md instructs running node scripts/chat.js and documents DEEPSEEK_API_KEY. The script only sends the prompt to api.deepseek.com and prints the response (no other file reads or odd network endpoints). However SKILL.md and repository include a config.env with a plaintext API key, which expands the skill's scope by embedding credentials in the package.

Install Mechanism

There is no install spec (instruction-only skill with a small helper script). This lowers install-time risk because nothing is downloaded or extracted during install.

Credentials

The runtime legitimately needs a DEEPSEEK_API_KEY, but the registry metadata does not declare any required env vars or a primary credential — an inconsistency. Worse, a plaintext API key is included in config.env (DEEPSEEK_API_KEY=sk-058c4513...), which is disproportionate and risky because it may be a valid secret bundled in the skill.

Persistence & Privilege

The skill does not request persistent 'always' inclusion, does not modify other skills, and does not require elevated system privileges. Autonomous invocation is allowed by default but is not combined with other high-risk factors here.

What to consider before installing

This skill is a simple DeepSeek API client, but it has notable problems you should address before using it: 1) Do not use the embedded API key in config.env — it may be real and is exposed in the package. Replace it with your own key and, if you already used the included key, rotate/revoke it immediately. 2) The package metadata claims curl is required but the script uses node; ensure you run it with node and that the environment matches the runtime expectations. 3) The registry metadata failing to declare DEEPSEEK_API_KEY is an inconsistency — expect to set DEEPSEEK_API_KEY in your environment rather than trusting config.env. 4) Confirm the DeepSeek API hostname (api.deepseek.com) and the project's homepage independently before sending sensitive data. If you intend to install or run this skill, remove the bundled config.env, supply your own API key from a trusted source, and verify the key has only the minimal permissions you need.

DeepSeek 聊天

DeepSeek 官方 API，支持中文对话、文件处理、联网搜索。

环境变量

DEEPSEEK_API_KEY=sk-xxx

使用方法

node scripts/chat.js "你好"

模型

• deepseek-chat - 通用对话
• deepseek-coder - 代码
• deepseek-reasoner - R1 深度思考

价格

超级便宜：

• 输入：¥0.27 / 百万 tokens
• 输出：¥1.10 / 百万 tokens