Use DeepSeek TUI CLI as an autonomous code assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill is mostly clear about using DeepSeek TUI for coding, but it asks users to install and run an unpinned third-party autonomous CLI with broad workspace file and shell access.

Install only if you trust the DeepSeek TUI package source and are comfortable giving it access to the current workspace. Prefer a pinned, reviewed version and run interactive mode only in a limited project directory without unrelated secrets, credentials, or sensitive repositories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-29
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

markdown

- **Homebrew:** `brew install hmbown/tap/deepseek-tui`
- **npm:** `npm install -g deepseek-tui`

Technical Analysis

The skill directs users or agents to install deepseek-tui globally from mutable third-party distribution channels without pinning a reviewed version, package digest, commit, or cryptographic checksum.

The npm command resolves the package version selected by the registry at installation time. It may also execute package lifecycle scripts with the privileges of the invoking user. The Homebrew command similarly trusts a third-party tap and its current formula definition. Consequently, the effective code installed can change after this skill has been reviewed.

There is no evidence in the audited file that the current package or Homebrew formula is malicious. The confirmed weakness is that the installation instructions do not provide dependency immutability or integrity verification, creating a supply-chain execution path if the package, publisher account, registry, repository, or Homebrew tap is compromised.

Attack Path

1. An attacker compromises the npm publisher account, package, source repository, or hmbown/tap Homebrew tap.
2. The attacker publishes a malicious package release or modifies the Homebrew formula to retrieve or install attacker-controlled content.
3. A user or autonomous agent follows lines 28-29 and installs the dependency without a version or checksum constraint.
4. The package manager resolves the attacker-controlled version or formula.
5. Malicious lifecycle, installation, or executable code runs under the account performing the installation.
6. The installed global CLI can subsequently execute attacker behavior whenever deepseek is invoked.

Impact Assessment

Successful exploitation permits arb ...[truncated 619 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, such as an exact npm version rather than the registry's current release.
2. Prefer a lockfile-backed, project-local installation over a global installation.
3. Verify package integrity using a trusted digest, signed release artifact, provenance attestation, or equivalent cryptographic mechanism.
4. For Homebrew, pin or otherwise verify the exact formula revision and downloaded artifact checksum. Avoid relying solely on a mutable third-party tap.
5. Review npm lifecycle scripts and Homebrew formula installation logic before use. Disable lifecycle scripts during installation when they are unnecessary.
6. Run the CLI as an unprivileged user inside a sandbox or container with access restricted to the required workspace.
7. Do not expose unrelated repositories, SSH keys, cloud credentials, or API tokens to the interactive tool.
8. Document the trusted package publisher, expected version, checksum, and verification procedure directly in the skill.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly promotes deepseek run as having full tool-calling, filesystem read/write capability, and shell execution across the workspace, but it does not provide a clear, prominent warning about the security consequences of granting an autonomous agent that level of access. This can lead users to run the tool in sensitive repositories or directories without understanding the risk of data exposure, destructive edits, or command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.