Deepseek V4

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward DeepSeek API command-line wrapper, with expected remote prompt submission and no hidden persistence or destructive behavior found.

Install only if you are comfortable sending prompts, system prompts, and chat history to DeepSeek's remote API. Avoid entering secrets or regulated data unless approved, and consider pinning the OpenAI SDK dependency or running the scripts in a constrained environment for stronger supply-chain hygiene.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/ask.py:4

Finding

Unbounded OpenAI SDK Dependency in One-Shot Query Script

Content

View full analysis

=3.10" # dependencies = ["openai>=1.0.0"] # /// ``` ### Technical Analysis The PEP 723 inline dependency metadata permits `uv run` to resolve and execute any future version of the `openai` package at or above version 1.0.0. The project does not provide an exact version constraint, upper version bound, committed lockfile, or package integrity hashes. As a result, the dependency code executed by the script can change without any corresponding change to the audited project. If a future package release or its distribution channel is compromised, malicious package code could execute during import or normal SDK operation. The dependency runs in the same process as the script and can therefore access the `DEEPSEEK_API_KEY` environment variable and other resources available to the invoking user. This finding concerns supply-chain exposure and version drift; the reviewed project does not itself demonstrate that the current `openai` package is malicious. ### Attack Path 1. An attacker compromises a future compatible release of the `openai` package or its package-distribution path. 2. A user invokes the documented `uv run .../scripts/ask.py` command. 3. `uv` resolves the unbounded `openai>=1.0.0` requirement to the compromised release. 4. Python imports the resolved package in `scripts/ask.py`. 5. Malicious dependency code executes with the privileges of the invoking user. 6. The code can read process environment values such as `DEEPSEEK_API_KEY` and potentially transmit them through available network access. ### Impact Assessment Successful exploitation could expose the DeepSeek API credential and any other environment data readable by the process. Because dependency code executes with the user's privileges, it ...[truncated 323 chars]

Remediation

View remediation

"] ``` 2. Generate and commit a lockfile when the execution and packaging workflow supports one. 3. Require package hashes or equivalent integrity verification in automated installation workflows. 4. Update the dependency only through an explicit review process that includes changelog inspection, vulnerability scanning, and regression testing. 5. Run the script with a minimal environment and only the credentials it requires. 6. Where practical, isolate execution in a restricted container or sandbox with limited filesystem and network access. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/chat.py:4

Finding

Unbounded OpenAI SDK Dependency in Multi-Turn Chat Script

Content

View full analysis

=3.10" # dependencies = ["openai>=1.0.0"] # /// ``` ### Technical Analysis The script declares the `openai` SDK with only a minimum version. When the documented `uv run` workflow resolves this metadata, any later compatible release can be installed and executed. There is no exact pin, upper bound, lockfile, or integrity hash to ensure that users execute the dependency version that was reviewed. Third-party package code executes in the same Python process as `chat.py`. It therefore inherits the invoking user's privileges and can access the environment containing `DEEPSEEK_API_KEY`. A compromised future package release could execute malicious logic when imported or used by the script. This is a supply-chain hardening issue. No evidence in the reviewed files establishes that the currently available dependency is malicious. ### Attack Path 1. An attacker publishes or causes distribution of a compromised future `openai` release satisfying `>=1.0.0`. 2. A user starts `scripts/chat.py` through the documented `uv run` command. 3. The dependency resolver selects the compromised package version. 4. The script imports `OpenAI` from that package. 5. Attacker-controlled package code executes under the invoking user's account. 6. That code can access `DEEPSEEK_API_KEY`, conversation data passed through the process, and other user-accessible resources. ### Impact Assessment Exploitation could disclose the DeepSeek API key, prompts, system instructions, and conversation history handled by the chat process. Malicious dependency code could additionally access files, environment variables, and network resources available to the invoking user. The maximum privilege is normally that of the account running the script; thi ...[truncated 98 chars]

Remediation

View remediation

"] ``` 2. Use a committed lockfile and integrity hashes where supported by the selected `uv` workflow. 3. Perform controlled dependency upgrades rather than resolving arbitrary future releases during normal execution. 4. Add automated dependency vulnerability and provenance checks to the release process. 5. Minimize exposed environment variables before launching the script and provide only the required API credential. 6. Execute the chat client in a sandbox or container with restricted filesystem and network permissions where feasible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description suggests an operational CLI tool that lets a user use DeepSeek V4 Flash/Pro for one-shot questions, thinking mode, and chat. However, this code chunk does not call any API, parse arguments, send prompts, manage chat state, or provide model interaction. Its sole function is to print static documentation about models, pricing, and example usage. That is a materially different primary purpose from the declared functionality, so this is a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages users to send prompts to DeepSeek's remote API but does not clearly warn that prompt contents may leave the local environment and be processed by a third party. Users may unknowingly submit sensitive code, credentials, internal documents, or regulated data, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

2. Set environment variable:

bash

export DEEPSEEK_API_KEY=your_key_here
# Add to ~/.zshrc or ~/.bashrc to persist

Models

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This script transmits the user's prompt, and optionally a system prompt, to the DeepSeek API via client.chat.completions.create(...). Although the network call is part of the tool's purpose, there is no explicit disclosure in the script output or docstring that user-provided content will be sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

In streaming mode, the script sends the same prompt data to the DeepSeek API using a streamed chat completion request. The file contains no confirmation prompt or visible disclosure that entered content leaves the local environment and is processed by a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

client = OpenAI(
        api_key=get_api_key(),
        base_url="https://api.deepseek.com/v1",
    )

    messages = []

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ask.py (reported line 63)May include surrounding context.

python

client = OpenAI(
        api_key=get_api_key(),
        base_url="https://api.deepseek.com/v1",
    )

    messages = []

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/chat.py (reported line 49)May include surrounding context.

python

client = OpenAI(
        api_key=get_api_key(),
        base_url="https://api.deepseek.com/v1",
    )

    messages = []

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README encourages users to configure an API key and send prompts to a third-party LLM service, but it does not clearly disclose that user prompts, chat history, and possibly sensitive terminal-entered content will leave the local environment and be transmitted to DeepSeek. This is a real privacy and data-handling risk because users may reasonably assume a CLI-like workflow is local unless remote transmission and retention implications are stated explicitly.

Content

No source excerpt is available for this finding.