ClawHub

DeepSeek API Toolkit

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only DeepSeek API guide whose credential and network examples fit its stated purpose, though users should handle prompts and API keys carefully.

Install only if you intend to use DeepSeek as a third-party API provider. Keep real API keys in environment variables or a secrets manager, avoid pasting secrets into examples or logs, and do not send confidential, regulated, personal, or proprietary content to DeepSeek unless that data flow is approved for your use case.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guide repeatedly instructs users to send prompts and bearer credentials to a third-party API, but it does not clearly warn that prompt contents may include sensitive data and will be transmitted off-host. In a skill or agent context, this omission can lead users to unknowingly exfiltrate confidential prompts, code, or business data to an external provider.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The authentication examples normalize hard-coded API key usage such as `api_key="sk-your-key-here"` and bearer headers without a clear warning against embedding real secrets in source code, logs, screenshots, or shared snippets. In practice, users often copy these patterns verbatim, which increases the risk of credential leakage and subsequent unauthorized API use.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal