Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent but should be reviewed because broad automatic triggers can send repository questions to DeepWiki through shell/curl without an explicit privacy confirmation.
Install only if you are comfortable with repository names and questions being sent to DeepWiki. Use it for public repositories and avoid prompts containing private code, secrets, customer data, incident details, or proprietary architecture. Consider tightening triggers or requiring explicit user confirmation before outbound queries.
The trigger scope is broad enough to activate on many normal repository-related questions, which can cause the agent to send user queries to this external skill when the user did not explicitly ask for DeepWiki. In this skill's context, that creates an unintended data-sharing and tool-selection risk because seemingly ordinary codebase questions may be routed to a third-party service.
The README explains that the skill posts questions to DeepWiki's remote MCP endpoint but does not clearly warn that repository names, prompts, and possibly sensitive user-entered context are transmitted to a third party. In an agent environment, this omission is dangerous because users may assume a local code lookup rather than an external network call, leading to unintentional disclosure.
The skill explicitly instructs use of shell execution via a helper script and direct curl, but it does not declare any tool scope or allowed-tools boundary. That weakens enforcement and reviewability, making it easier for the skill to obtain broader execution capability than users or the platform may expect.
The trigger phrase 'ask deepwiki' includes the generic command word 'ask', which may conflict with built-in command handling and cause ambiguous or unintended routing. While not directly leading to code execution, trigger shadowing can bypass expected UX boundaries and make accidental external queries more likely.
Several triggers are broad phrases like 'check the source', 'repo architecture', and 'how does X work in', which can match ordinary developer requests and invoke this skill unexpectedly. Because the skill sends queries to an external service, over-broad activation increases the risk of unintended data disclosure and user confusion about where content is being sent.
The skill description emphasizes convenience ('No API key, no auth, free') but does not prominently warn that repository names and user questions are transmitted to an external network service. Users may assume a local code lookup, causing inadvertent sharing of sensitive repository context or proprietary questions.
The skill contains a direct curl fallback that transmits user-provided repository names and questions to an external endpoint. External transmission is expected for this skill's function, but it is still security-relevant because it can leak sensitive prompts or internal repository details if activation or inputs are not properly constrained.
- Use `topics` to find relevant documentation sections
- Use `docs` for broader context (but note: output can be very large)
## Direct curl (fallback)
If the helper script is unavailable:
This skill performs an outbound HTTP POST to an external MCP endpoint, transmitting tool arguments off-host. In the context of a codebase-analysis skill, that is security-relevant because prompts and repository identifiers can contain sensitive internal information, and the skill description may encourage users to submit source-related questions without realizing data leaves the environment.
call_mcp() {
local tool="$1"
local args_json="$2"
curl -s -X POST "$DEEPWIKI_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"$tool\",\"arguments\":$args_json}}" \
The script sends the user-provided repository/question content to a third-party remote service without any warning, consent prompt, or data-sensitivity guard. That creates a real confidentiality risk because users may paste proprietary code details, secrets, incident context, or internal architecture questions assuming this is a local helper.
The trigger phrases are broad and common in normal developer conversation, so the skill may activate in contexts where the user did not intend to invoke DeepWiki. Because the skill also requests command execution capability, accidental invocation becomes more dangerous by unnecessarily exposing privileged behavior during routine discussions about source code or architecture.
The regex patterns are insufficiently constrained and can match a wide range of unrelated user messages, especially patterns like deepwiki or how does .+ work in. Ambiguous matching raises the likelihood of unintended activation, which is a security concern here because the skill carries broader-than-necessary execution privileges.
The skill’s stated purpose is to query DeepWiki for information about public GitHub repositories, but it requests the generic exec tool, which can enable arbitrary command execution beyond that scope. This violates least privilege and increases the blast radius if later prompts, tool wrappers, or downstream content influence command construction.
No suspicious patterns detected.