Deepvista Recipe Export Knowledge As Skills

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 0.1.0-alpha.21

Overview

This skill is a straightforward DeepVista recipe export helper, with disclosed file creation for installing exported skills and a supply-chain caution around its unpinned CLI dependency.

Install only if you trust DeepVista and the deepvista-cli package source. Review exported recipes before adding them to your agent skills directory, because those generated SKILL.md files may affect future agent behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: uv
    package: deepvista-cli
    bins: [deepvista]

Technical Analysis

The Skill declares deepvista-cli as an installation dependency without specifying an exact version, cryptographic hash, signature, or immutable source reference. Consequently, installation can resolve package content that differs from the version originally reviewed.

This creates a supply-chain risk if the package publisher account, package registry, release process, or dependency resolution path is compromised. The dependency's executable code is outside this repository and was therefore not available for review in the audited project.

Attack Path

1. An attacker compromises the package publisher, package registry, or another relevant component of the dependency supply chain.
2. The attacker publishes a malicious or compromised release under the deepvista-cli package name.
3. A user or agent installs the Skill's declared dependency without an exact version or integrity constraint.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code may execute during package installation or when the documented deepvista commands are invoked.

This path depends on compromise or malicious control of the external package supply chain; the audited SKILL.md does not itself contain an embedded malicious payload.

Impact Assessment

A compromised dependency could execute code with the privileges of the user or agent process performing the installation or invoking the CLI. Depending on that account's access, this could expose local files, environment variables, credentials, recipe data, and agent configuration. It could also modify files or invoke network services within the same permission boundary.

No ev ...[truncated 164 chars]

Remediation

View remediation

Remediation Suggestions

• Pin deepvista-cli to a specific version that has undergone security review.
• Use cryptographic hashes, signed artifacts, or package-manager lock data to verify integrity where supported.
• Install only from an explicitly trusted package registry and document the expected publisher and source.
• Review package metadata, installation hooks, transitive dependencies, and the installed executable before deployment.
• Test the CLI in a sandbox or least-privileged environment before allowing access to sensitive recipes, credentials, or agent configuration.
• Establish a controlled dependency-update process so version changes require review rather than being resolved automatically.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

3. Save each skill to the agent's skills directory:

   bash

   mkdir -p ~/.agents/skills/<skill-name>/
   # Write the SKILL.md content from the JSON output to that directory