Security audit

你聊我干

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real and coherent DeepSeek-import purpose, but it can install dependencies, fetch external pages, write into local projects, and persist context without clear approval gates.

Install only if you are comfortable with a skill that may open DeepSeek links in a headless browser, install Puppeteer, create or modify project files, and save context across sessions. Use it with chats you own, prefer a fresh or sandboxed directory, review planned file writes before allowing overwrites, and inspect extracted code before running or deploying it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill’s stated purpose is to read DeepSeek share links, but it instructs the agent to execute a local Node script and, if needed, install Puppeteer via npm. That expands the trust boundary from passive retrieval into arbitrary local code execution and package installation, which can modify the system and introduce supply-chain risk unrelated to simply reading a link.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest presents the skill as reading a chat link and continuing development, but the workflow authorizes broad file creation, modification, and project generation on disk. This is a scope mismatch: a user may expect analysis of a link, while the skill can materially alter local repositories and create new files without an explicit boundary or consent step.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The instruction to append work to memory files creates cross-session persistence beyond the stated purpose of reading a shared chat and continuing development. Persisting extracted content or context can retain sensitive project details, links, or code longer than necessary and broaden exposure across future sessions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly promises automatic extraction of code and writing files into a project, but it does not warn users that local files may be created or overwritten. In a skill that imports code from an external chat share link and then continues development, this can lead to unintended modification of the user's workspace, including clobbering existing files or introducing unreviewed code into a trusted project.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README describes detecting DeepSeek share links, rendering pages with Puppeteer, extracting code, and continuing development, but it does not disclose the privacy and network risks of fetching remote content. Because this skill processes externally hosted, potentially adversarial pages and then turns extracted content into local files, the missing warning increases the chance that users will unknowingly expose metadata, fetch untrusted content, or trust imported code without review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs writing extracted files and a README to disk but does not warn the user that files will be created or modified. Silent file writes can overwrite existing work, pollute repositories, or materialize untrusted code from an external source into the local environment without informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow requires using a headless browser to access external share links but does not disclose that network access will occur or that remote content will be rendered in a browser context. This matters because loading third-party pages can expose metadata, trigger trackers, and fetch additional untrusted resources beyond a simple static read.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs installing Puppeteer with npm if it is missing, without warning about dependency installation or system modification. Installing packages at runtime introduces supply-chain risk, changes the local environment, and can execute package lifecycle scripts, making this significantly more dangerous than the skill description suggests.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The tagline says the user chats in DeepSeek while the skill will 'do the work' in OpenClaw, which describes a very broad delegated capability without clear scope, trigger conditions, or safety boundaries. In an agent skill, this ambiguity can lead to over-activation, unsafe assumptions about authority, and unintended execution of development-related actions based on loosely defined external chat content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example instructs the agent to install and run Puppeteer and then perform browser automation against an external URL without any explicit warning, confirmation step, or trust boundary. In a skill whose purpose is to fetch and continue work from chat-share links, this normalizes executing dependency installation and network-driven browser actions on behalf of the user, which can expose the environment to unreviewed code execution, unexpected network access, and unsafe content ingestion.

Static analysis

No suspicious patterns detected.