T09 · Insecure Skill Coding Practices
Warning
- Location
deepseek-api-guide.md:47- Finding
API integration templates encourage hardcoded credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
DeepSeek API Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed DeepSeek API documentation skill with no executable install behavior, but users should handle API keys and sensitive prompt data carefully.
Install only if you want Chinese-language DeepSeek API guidance. Do not paste real API keys into source code or shell history, and do not send sensitive customer, regulated, proprietary, or secret data to DeepSeek unless your organization has approved that use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The primary descriptive text is presented in Chinese, and the README does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an English/locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation conditions are broad enough to match many ordinary AI/API-related requests, which can cause this skill to activate when the user did not specifically ask for DeepSeek-focused guidance. Over-broad activation increases the chance of context hijacking, irrelevant vendor steering, and unintended disclosure or processing of user context under the wrong skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance recommends placing a long knowledge base into the system prompt for caching, but it does not warn that this may send proprietary, regulated, or personal data to a third-party API. In a cost-optimization skill, that omission is meaningful because readers are encouraged to maximize reuse of large prompt prefixes, which can normalize bulk external data transfer without data-classification checks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The optimization example hard-codes an instruction to translate content into Chinese, and the surrounding document is entirely written as prescriptive guidance in Chinese without any opt-in or locale justification. Per the policy, forcing a specific language without user choice can be a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example sends full conversation history to an external API for summarization without warning about privacy, confidentiality, or retention risks. This is dangerous because conversation histories often contain credentials, personal data, or sensitive business context, and the cost-saving framing may incentivize sending everything rather than minimizing or filtering data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Chat Completions（对话补全）
text POST https://api.deepseek.com/chat/completionsFIM Completions（代码补全）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Chat Completions（对话补全）
text POST https://api.deepseek.com/chat/completionsFIM Completions（代码补全）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Chat Completions（对话补全）
text POST https://api.deepseek.com/chat/completionsFIM Completions（代码补全）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Chat Completions（对话补全）
text POST https://api.deepseek.com/chat/completionsFIM Completions（代码补全）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file includes multiple examples that send user-provided message content to the DeepSeek API, but the surrounding documentation does not warn users that prompts and conversation data will be transmitted to an external service. For markdown files, omission of warnings about behaviors affecting user data or privacy is in scope.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
);
text ### curl ```bash curl https://api.deepseek.com/chat/completions \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill content, including headings, guidance, and examples, is presented only in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document states '中文场景用中文' and provides examples directing the assistant to answer in Chinese as the preferred/default behavior. This is a natural-language locale policy constraint without any indication of user opt-in or alternative language selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The guidance recommends using Chinese system prompts for Chinese scenarios without an explicit user opt-in or preference check. While not directly enabling code execution or data exfiltration, it can override user expectations, change instruction semantics, and create policy or usability issues if the system prompt language is silently altered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
A language or locale policy issue applies when a skill forces a specific language without user opt-in. This guide is entirely Chinese-language and does not indicate that Chinese is optional or that the document is specifically intended for a Chinese-only audience.
- Content
Static analysis
No suspicious patterns detected.