DeepWiki MCP Skill

• Outcome: Pass
• Latest audit: May 29, 2026, 8:13 PM
• Version:
  1.0.0

Overview

This skill is a straightforward DeepWiki helper that sends GitHub repository questions to an external MCP service, with no evidence of hidden or harmful behavior.

Install this only if you are comfortable using uxc, creating the deepwiki-mcp-cli link, and sending repository names plus your questions to DeepWiki. Do not include secrets, access tokens, proprietary private-code details, or sensitive internal context unless sharing that information with DeepWiki is authorized.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to send repository names and free-form questions to `mcp.deepwiki.com` but does not clearly warn that these inputs leave the local environment and are transmitted to a third-party service. This can lead users to disclose sensitive repository identifiers, internal project names, code-related questions, or other confidential context under the assumption the skill is purely local documentation tooling.

VirusTotal

65/65 vendors flagged this skill as clean.