T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Global Installation of a Mutable Third-Party CLI
- Content
View full analysis
- Remediation
View remediation
Security audit
DeepMiner Skills
Security checks for vulnerabilities and agentic risk
Overview
This DeepMiner helper is mostly purpose-aligned, but it installs global software, stores credentials or raw results, and can forward full task data through background/session channels without enough scoping.
Review this skill before installing. Use it only with a trusted DeepMiner account and a least-privilege access key, avoid sending sensitive prompts or files unless intended, prefer a pinned/local CLI install, and do not run the bundled polling scripts with shared or arbitrary status paths or unverified destination sessions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Predictable Shared Temporary Cache Allows Symlink Attacks and Version Poisoning
- Content
View full analysis
/dev/null || stat -c %Y "$CACHE_FILE") )) -lt 86400 ]; then LATEST=$(cat "$CACHE_FILE") else LATEST=$(curl -sL "https://clawhub.ai/dmpm-mininglamp/deepminer-skill" | grep -o 'version:"[^"]*"' | head -1 | cut -d'"' -f2) echo "$LATEST" > "$CACHE_FILE" fi ``` ### Technical Analysis The version cache uses a fixed, predictable path in the shared `/tmp` directory. The code does not verify file ownership, permissions, file type, or whether the path is a symbolic link. It also does not validate that cached content has a legitimate version-number format. A local attacker can pre-create the cache with attacker-controlled content. If its timestamp is recent, the Skill trusts that content as the latest version. An attacker may also place a symbolic link at the cache path. The shell redirection then follows that link when refreshing the cache and truncates or overwrites the linked target if the victim has permission to write it. The check and subsequent read or write are separate operations, creating an additional time-of-check/time-of-use race. ### Attack Path **Cache poisoning path:** 1. A local attacker creates `/tmp/dmskills_version_cache`. 2. The attacker writes a fabricated version string and gives the file a recent modification time. 3. The victim performs the mandatory version check. 4. The script reads the attacker-controlled cache rather than querying ClawHub. 5. The agent may report a false update requirement or suppress a legitimate update warning. **Symlink overwrite path:** 1. A local attacker creates `/tmp/dmskills_version_cache` as a symbolic link to a victim-writable target. 2. The cache is ...[truncated 614 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dm-poll.sh:15- Finding
Caller-Controlled Status Paths Permit File Clobbering and Sensitive Result Exposure
- Content
View full analysis
[max_timeout_minutes]" exit 1 fi ``` The file is then overwritten with a complete response: ```bash write_status() { local state="$1" local message="$2" local result_json="$3" cat > "$STATUS_FILE" << EOF STATE=$state THREAD_ID=$THREAD_ID MESSAGE=$message RESULT_JSON=$result_json TIMESTAMP=$(date -Iseconds) EOF } ``` The same pattern occurs in `scripts/dm-poll-once.sh`: ```bash THREAD_ID="$1" STATUS_FILE="$2" MAX_TIMEOUT="${3:-60}" if [ -z "$THREAD_ID" ] || [ -z "$STATUS_FILE" ]; then echo "DM_POLL_ERROR:invalid arguments" exit 3 fi ``` ```bash write_status() { local state="$1" local prev_state="$2" local result="$3" mkdir -p "$(dirname "$STATUS_FILE")" 2>/dev/null || true echo "STATE=$state" > "$STATUS_FILE" echo "THREAD_ID=$THREAD_ID" >> "$STATUS_FILE" echo "PREV_STATE=$prev_state" >> "$STATUS_FILE" echo "TIMESTAMP=$(date -Iseconds)" >> "$STATUS_FILE" echo "$result" > "${STATUS_FILE}.json" } ``` ### Technical Analysis Both scripts accept an unrestricted output path and write to it using truncating shell redirection. They do not confine output to a private directory, reject symbolic links, ensure that the target is a regular file, use atomic exclusive creation, or establish restrictive permissions. The one-shot helper additionally creates parent directories and writes the complete DeepMiner response to a companion `.json` file. These responses can contain prompts, task output, metadata, and artifac ...[truncated 1711 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/dm-poll-notify.sh:17- Finding
Unvalidated Destination Enables Cross-Session Disclosure of Complete DeepMiner Results
- Content
View full analysis
/dev/null; then encoded=$(echo -n "$result" | base64 | tr -d '\n' 2>/dev/null || echo "") fi # If base64 encoding fails, use the original result if [ -z "$encoded" ]; then encoded="$result" fi # Send notification local message="DM_POLL_NOTIFY:${THREAD_ID}:${state}:${encoded}" echo "[NOTIFY] Sending notification: state=$state" # Use sessions_send to send the message if command -v sessions_send &> /dev/null; then sessions_send --sessionKey "$PARENT_SESSION" --message "$message" 2>/dev/null || true else # If sessions_send is unavailable, output to standard output echo "$message" fi } ``` The complete result is passed to the notification function when state changes: ```bash if [ "$state" != "$last_state" ]; then echo "[STATE_CHANGE] $last_state -> $state" send_notification "$state" "$result" last_state="$state" fi ``` ### Technical Analysis The script does not derive the parent session from trusted runtime context and does not verify that `PARENT_SESSION` owns or is authorized to receive data from `THREAD_ID`. Any caller capable of invoking the helper can choose the destination session key. The payload is the complete output of `dm-cli thread result`, not a minimal status message. It can include task prompts, assis ...[truncated 1954 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This skill claims to be a general DM interaction primer, but the content goes further by directing active thread polling, result parsing, direct user notification, and state-specific control logic. Hidden operational behavior in a broadly triggered skill can cause users or calling agents to invoke capabilities they did not intend, including background monitoring and broad result disclosure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This skill claims to be a general DM interaction primer, but the content goes further by directing active thread polling, result parsing, direct user notification, and state-specific control logic. Hidden operational behavior in a broadly triggered skill can cause users or calling agents to invoke capabilities they did not intend, including background monitoring and broad result disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger language is extremely broad and instructs that any mention of DM/DeepMiner must load this skill first. Overbroad activation increases the likelihood that the skill will run in contexts where its installation, polling, forwarding, or background-session behaviors are unnecessary or unsafe.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation instructs installation of a global package and initialization of credentials on the host, expanding from task guidance into host modification and secret handling. In an agent setting, this can lead to unnecessary software changes, persistence, and exposure of access keys without user awareness or proper safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill tells operators to initialize the CLI with an access key but provides no safety guidance on secret entry, storage, redaction, or output handling. In agent-operated terminals, this can expose credentials through command history, logs, screenshots, or downstream message forwarding.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The mandatory version-check workflow requires contacting an external site and caching data locally before every use, which exceeds the stated DM interaction purpose. This introduces an unnecessary outbound network dependency and trust chain that could be abused to influence behavior, leak usage patterns, or fail unpredictably in restricted environments.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates verbatim forwarding of all user prompts to DM and verbatim return of all DM last_messages, forbidding summarization or filtering. That creates a direct natural-language exfiltration path for sensitive user data, internal instructions, secrets, and unreviewed third-party output, with no minimization or policy checks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill gives conflicting instructions about whether subagents should directly message users or only emit output for the main agent to forward. In security-sensitive workflows, contradictory orchestration rules can cause duplicated, misrouted, or unintended disclosures, especially when results may contain sensitive content or file links.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The polling subagent is instructed to traverse all messages and emit all content and attachment links verbatim. This can disclose sensitive conversation history, internal tool outputs, and authenticated file URLs beyond the minimum needed for task completion, especially because the subagent operates automatically in the background.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Repeated instructions to always present original DM output and files establish a blanket disclosure policy with no sensitivity checks or contextual controls. In the context of a broadly triggered automation skill, this materially increases the risk of leaking confidential results, attachments, or access-controlled URLs to the wrong recipient or session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script forwards the full
dm-cli thread result --jsonpayload to another session viasessions_send, base64-encoding it but not minimizing or redacting content. If the DM result contains sensitive model output, internal metadata, secrets, or user data, this creates a cross-session data disclosure channel and can leak information to a broader or unintended audience; the DM skill context increases risk because this script is explicitly designed to bridge data from DeepMiner into a parent session.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script documentation claims results are sent directly to the user without main-agent involvement, but the implementation also writes state and raw DM result data to local status files, including a separate JSON sidecar. This creates a confidentiality and expectation mismatch: operators may assume ephemeral notification-only behavior while the script actually persists potentially sensitive DM output on disk where other local processes or users could access it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
On completed, ask_human, and failed states, the script extracts DM response content and forwards it verbatim to a user-facing messaging channel. If DM results contain sensitive data, secrets, internal URLs, or untrusted text, this can cause unintended disclosure to users or other recipients of that channel without any sanitization, classification check, or explicit consent flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script writes the full DM result JSON directly into a status file, which may include sensitive task output, prompts, internal metadata, or human-facing messages not intended for broad local exposure. If the status file is readable by other users, processes, logs, or downstream tooling, this creates an information disclosure risk without any minimization, redaction, or explicit operator warning.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description is written only in Chinese, which can indicate a fixed language presentation without offering users any language or locale choice. Under the policy, language constraints should either be optional for users or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Comments and terminal output strings such as usage, status, warnings, and errors are written in Chinese only. This imposes a specific language/locale on users without offering a choice or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's natural-language documentation and operational messages are written exclusively in Chinese, with no indication that language is configurable or intentionally restricted to a China-specific audience. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
- Content