Security audit

Deepvista Recipe Research To Recipe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DeepVista workflow helper, but users should understand that running a Recipe can expose the full knowledge base to that Recipe.

Install only if you trust the DeepVista CLI package source and the Recipes you choose to run. Before approving a Recipe run, assume it may inspect knowledge-base content beyond the cards you selected, and avoid running untrusted Recipes against sensitive workspaces.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party CLI Dependency
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:47
Finding: Recipe Runs Receive Unrestricted Knowledge-Base Access
Content: View full analysis
--input "Based on my research:
" ``` 6. **Check run status:** ```bash deepvista recipe status ``` ## Tips - Steps 1–4 are read-only. Step 5 (`recipe run`) is the only write operation — always confirm with the user before executing it. - The Recipe run has access to the full knowledge base; the `--input` flag focuses the run, it doesn't limit what the agent can see. ``` ### Technical Analysis The Skill explicitly states that every Recipe run can access the full knowledge base. The `--input` argument supplies a focused prompt but does not enforce an authorization boundary or restrict the agent to the cards selected during the research phase. The workflow requires user confirmation before starting a Recipe, which is a useful safeguard. However, the described confirmation concerns which Recipe to run and what context to pass; it does not require a separate, explicit acknowledgement that the Recipe can inspect unrelated knowledge-base content. This violates least-privilege principles when a task only requires a small set of selected cards. A defective, compromised, or intentionally hostile Recipe could use its broader permissions to inspect unrelated confidential records. Content retrieved from the knowledge base could also contain prompt-injection instructions that influence an agent possessing database-wide visibility. ### Attack Path 1. A user searches for and selects cards relevant to a limited research task. 2. The user chooses a Recipe that is compromised, untrusted, or behaves more broadly than expected. 3. The user confirms the Recipe b ...[truncated 1130 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.