ClawHub
Back to skill

Security audit

DeepMiner Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a DeepMiner helper, but conflicting instructions around background polling, notifications, and async task confirmation make it worth reviewing before installation.

Install only if you trust the DeepMiner CLI and are comfortable providing a DM AccessKey. Before using it for large or paid tasks, confirm which async flow your agent will follow: it should not start, cancel, force-interrupt, or resume DM tasks without clear user direction, and only one poller should run per DM thread.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
描述非常宽泛地说这是一个“通过 dm-cli 与 DeepMiner 系统交互”的 Skill，并强调何时应先阅读该 Skill，但代码并不是通用的 DM 交互层或使用说明，而是专门的轮询/通知实现。它除了调用 dm-cli 外，还会持续轮询 thread result、解析 JSON、写文件，并借助 sessions_send 或 message 主动向主会话/用户发通知。这些行为超出了描述中呈现的能力范围，因此描述不能准确代表代码实际行为。

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill gives mutually inconsistent instructions for how polling subagents should notify users: one section tells the subagent to use a direct message/send mechanism, while a later section says subagents must not use message tools and should rely on subagent_announce/main-agent forwarding. In practice, this can cause notification failure, lost task results, or unexpected cross-session messaging behavior, which is security-relevant when users rely on status updates for long-running or costly operations.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The instructions conflict on async_tag_task handling: one part says to keep polling, while another says to stop immediately, notify the user to confirm in the GUI, and only resume after the user returns. That inconsistency can lead to missed confirmations, duplicate pollers, orphaned tasks, or unintended continued automation against a user-gated workflow.

Static analysis

No suspicious patterns detected.