ClawHub
Back to skill

Security audit

DeepSeek Chat

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a simple DeepSeek chat CLI, but it ships an apparent plaintext DeepSeek API key and does not clearly warn about third-party prompt transmission.

Review this skill before installing. Do not rely on the bundled config.env key; treat it as exposed and remove or replace it with your own secret supplied securely at runtime. Avoid sending secrets, proprietary files, regulated data, or private prompts unless you are comfortable with that content being transmitted to DeepSeek. The package should also clarify or remove the file-processing and online-search claims unless those features are added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
config.env:1
Finding

Plaintext API Credential Stored in the Project

Content
View full analysis

Vulnerability Details

File Location: config.env:1
Vulnerability Type: Hardcoded secret / plaintext API credential
Risk Level: High

Vulnerable Code

env
DEEPSEEK_API_KEY=sk-058c451313aa4510a8a42818da613fe9

Technical Analysis

The project contains a DeepSeek API key in plaintext. The application reads the key from the DEEPSEEK_API_KEY environment variable in scripts/chat.js:3-4 and places it in the HTTP Authorization header at scripts/chat.js:27-28:

javascript
const API_KEY = process.env.DEEPSEEK_API_KEY;
const API_URL = 'https://api.deepseek.com';
javascript
headers: {
  'Authorization': `Bearer ${API_KEY}`,
  'Content-Type': 'application/json',
  'Content-Length': data.length
}

Although transmitting the credential to the documented DeepSeek HTTPS endpoint is required for the advertised functionality, distributing the credential in config.env exposes it to anyone who can access the project package, repository, backups, build artifacts, or shared filesystem. Environment-variable usage does not protect a secret when its value is committed alongside the source code.

Attack Path

  1. An attacker obtains a copy of the project or access to its source repository, package, backup, or build artifact.
  2. The attacker opens config.env and extracts the plaintext DeepSeek API key.
  3. The attacker uses the key as a Bearer token in requests to the DeepSeek API.
  4. Requests execute under the credential owner's API account until the key is revoked, expires, or is otherwise restricted.

Impact Assessment

An attacker may consume the account's API quota, incur financial charges, exhaust usage limits, and make API requests attributable to the credential owner. The precise scope is limited to the permissions and account resources granted to this key; the reviewed files do not establish broader host or system privileges.

Remediation
View remediation

Remediation Suggestions

  1. Immediately revoke the exposed credential and generate a replacement. Treat the current key as compromised even if unauthorized use has not yet been observed.
  2. Review provider-side usage and billing logs for suspicious requests made with the exposed key.
  3. Remove config.env from distributed packages, repository history, release artifacts, caches, and backups where feasible.
  4. Add config.env and equivalent local secret files to .gitignore and packaging exclusion rules.
  5. Supply the replacement key only at runtime through a secret manager, protected deployment configuration, or environment variable that is not committed to source control.
  6. Provide a safe template such as config.env.example containing only a placeholder:
env
DEEPSEEK_API_KEY=replace-with-your-own-key
  1. Apply provider-supported restrictions such as spending limits, scoped permissions, expiration, and key rotation.
  2. Add automated secret scanning to pre-commit hooks and CI pipelines to prevent future credential commits.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares use of an environment variable-based secret (DEEPSEEK_API_KEY) but does not define any tool scope such as permissions or allowed-tools. This creates an authorization/documentation gap: consumers cannot clearly tell what runtime capabilities the skill needs, which increases the chance of overbroad access or unsafe execution assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The metadata description and the visible documentation are written as Chinese-only and specifically advertise Chinese support, with no indication that other languages are supported or that the locale is intentionally restricted for a documented regional purpose. This can violate language or locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation states the skill supports file processing and online search, but it does not warn that prompts, file contents, or search-derived data may be transmitted to DeepSeek or other external services. This can lead users to unknowingly send sensitive data off-platform, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This CLI transmits the full user prompt to the external DeepSeek API, but the script does not clearly warn users at the point of use that their input will leave the local environment. That creates a privacy and data-handling risk, especially if users paste secrets, proprietary code, or personal data assuming the tool is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

All user-visible status, usage, and error messages in the script are presented in Chinese, with no option for the user to select another language. This creates a language/locale policy concern because the skill imposes a specific language without explicit opt-in or documented regional scope.

Content

No source excerpt is available for this finding.