deerflow-install-master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:51 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it asks users to run mutable third-party install code, grant Docker-level privileges, store API keys, and start background services without enough safety guidance.

Install only if you trust the DeerFlow upstream and can review the cloned repository before running its Make targets. Prefer a pinned commit, pinned dependencies, a dedicated low-privilege account or rootless Docker, restricted DeerFlow sandbox paths, protected API keys, and documented stop/cleanup steps before enabling bash or file-write tools.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Execution of Unpinned Third-Party Repository and Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–98
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

Repository retrieval and execution instructions at lines 63–74:

bash

cd /vol1/@apphome/trim.openclaw/data/workspace
git clone https://github.com/bytedance/deer-flow.git
cd deer-flow

bash

make docker-init   # First pull of the sandbox image
make docker-start  # Start all services

Unpinned package installation instructions at lines 96–98:

bash

pip install -U pip
pip install fastapi uvicorn httpx langchain langchain-openai \
  langgraph-cli[inmem] langgraph-checkpoint-sqlite tavily-python

Technical Analysis

The installation process clones the current state of a remote repository without checking out a reviewed commit, version tag, or cryptographically verified release. It then executes Make targets supplied by that repository. Consequently, the code executed during installation can change after this Skill has been reviewed.

The Python dependencies are also installed without exact version constraints, lockfiles, or package hashes. Package managers can therefore resolve different direct and transitive dependency versions on different installation dates. Installation hooks and subsequently imported package code execute with the permissions of the installing user.

Although the repository URL points to the declared official DeerFlow GitHub project and the listed packages do not appear to be typosquatted, the lack of version and integrity controls creates a supply-chain exposure.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, a package publisher, or a transitive dependency.
2. The attacker adds malicious build logic, installation hooks, or runtime code to a mutable release.
3. A user follows the Skill and clones the current repository state or installs the lat ...[truncated 746 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin DeerFlow to a reviewed commit hash or a specific signed release rather than cloning and executing the default branch.
2. Verify release signatures or published checksums before running any repository-provided Make target.
3. Pin every direct and transitive Python dependency to an audited version.
4. Generate and commit a lockfile that includes cryptographic hashes, and install dependencies with hash verification enabled.
5. Avoid upgrading pip implicitly during deployment; use a separately reviewed and pinned installer version.
6. Review the referenced Make targets and container definitions before granting them access to the Docker daemon.
7. Perform installation inside an isolated, nonprivileged environment with restricted filesystem and network access.
8. Add automated dependency vulnerability and integrity scanning to the installation workflow.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:47

Finding

Docker Group Membership Grants Root-Equivalent Host Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–55
Vulnerability Type: Excessive system permissions
Risk Level: Medium

Vulnerable Code

bash

# Check Docker permissions (required for Docker mode)
groups $USER | grep docker  # User should be in the docker group

The documented remediation for a permission failure is:

bash

sudo usermod -aG docker $USER

Technical Analysis

On conventional Docker installations, membership in the docker group permits unrestricted communication with the privileged Docker daemon. A group member can start containers with host directories mounted, alter namespaces, access devices, or launch privileged containers.

This access is generally considered root-equivalent because a user can mount the host root filesystem into a container and modify host-owned files. Permanently adding an application user to this group therefore crosses a significant privilege boundary and grants substantially more authority than merely starting DeerFlow.

Attack Path

1. A user encounters the documented Docker permission error.
2. The user runs sudo usermod -aG docker $USER as instructed and activates the new group membership.
3. DeerFlow, a compromised dependency, or another process executing as that user connects to the Docker daemon.
4. The process creates a privileged container or mounts the host root filesystem into a container.
5. It reads sensitive host files or modifies system configuration, executables, credentials, or startup resources.
6. The attacker obtains effective host-level administrative control.

Impact Assessment

Exploitation can lead to root-equivalent control over the Docker host. This may include access to system files, application data, credentials, container secrets, other workloads, and mounted storage.

The exposure is not limited to DeerFlow: every process executing under the newly authorized account can potentially control ...[truncated 107 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a prominent warning that Docker group membership is normally root-equivalent.
2. Do not present permanent Docker group membership as the default solution to a permission error.
3. Prefer rootless Docker or another daemon configuration that does not expose a privileged host socket.
4. Where rootless operation is unavailable, require an administrator to run narrowly defined deployment commands rather than granting the application account persistent daemon access.
5. Use a dedicated deployment account with no unrelated workloads, interactive access, or sensitive credentials.
6. Restrict access to the Docker socket and periodically audit group membership.
7. Apply container hardening controls, including nonprivileged users, capability removal, read-only filesystems, restricted mounts, and seccomp or AppArmor policies.
8. Remove unnecessary Docker group membership after deployment if continued daemon access is not required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

创建 `_meta.json` 和 `SKILL.md`，描述能力、触发词、使用示例。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad (e.g. '安装 DeerFlow', '部署 DeerFlow 2.0') and provide no exclusion criteria or confirmation step, so the skill may be invoked in contexts where the user did not explicitly intend repository cloning, service startup, or configuration changes. In this skill, unintended invocation is more dangerous because later steps include downloading code, editing files, handling API keys, and launching local services.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

**常见问题**：
- ❌ Python 3.11 会触发 PEP 695 语法错误 → 应用补丁（见阶段 2）
- ❌ Docker permission denied → 将用户加入 docker 组：`sudo usermod -aG docker $USER`

### 阶段 2：获取 DeerFlow 仓库

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to place API keys in environment files and enables file-system and shell-capable tools, but it does not present a clear warning about secret exposure, arbitrary command execution, or file access risks. In this context, the combination of credentials plus read/write/bash tooling materially increases the chance of data leakage, destructive file changes, or execution of unsafe commands.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

export PYTHONPATH=$(pwd):.

# 允许阻塞调用（Python 3.11 必需）
nohup .venv/bin/langgraph dev \
  --port 2024 \
  --no-browser \
  --no-reload \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

export PYTHONPATH=$(pwd):.

# 允许阻塞调用（Python 3.11 必需）
nohup .venv/bin/langgraph dev \
  --port 2024 \
  --no-browser \
  --no-reload \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

export PYTHONPATH=$(pwd):.

# 允许阻塞调用（Python 3.11 必需）
nohup .venv/bin/langgraph dev \
  --port 2024 \
  --no-browser \
  --no-reload \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

export PYTHONPATH=$(pwd):.

# 允许阻塞调用（Python 3.11 必需）
nohup .venv/bin/langgraph dev \
  --port 2024 \
  --no-browser \
  --no-reload \

Static analysis

No suspicious patterns detected.