DeepWiki MCP Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its setup includes running an unpinned third-party shell installer that deserves user review.

Install only after you trust the uxc distribution path. Prefer a pinned, verified package over the curl-and-bash installer, review any installer before running it, do not use sudo unless required and understood, and do not send secrets, private repository names, proprietary code, or confidential questions to DeepWiki unless that sharing is approved.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31

Finding

Mutable Remote Shell Script Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://raw.githubusercontent.com/holon-run/uxc/main/scripts/install.sh -o install-uxc.sh
less install-uxc.sh
bash install-uxc.sh

Technical Analysis

The installation instructions download a shell script from the mutable main branch of an external GitHub repository and then execute it with Bash. The URL is not pinned to an immutable commit, and the downloaded file is not authenticated through a cryptographic signature or verified against a trusted checksum.

Although the instructions recommend reviewing the file with less, this is a manual safeguard and does not enforce verification. The upstream script can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer account, release process, DNS or network trust chain could therefore change the effective code executed by users without requiring any modification to this project.

Retrieving documentation through DeepWiki requires network access, but executing mutable third-party installation code is not the minimum privilege necessary for the Skill's core query functionality. It is an optional setup mechanism that materially expands the supply-chain attack surface.

Attack Path

1. An attacker compromises the upstream holon-run/uxc repository, a maintainer account, or the process that publishes scripts/install.sh.
2. The attacker modifies the installer on the mutable main branch to contain malicious shell commands.
3. A user follows the installation instructions in SKILL.md.
4. curl downloads the attacker-controlled version as install-uxc.sh.
5. The user runs bash install-uxc.sh.
6. The malicious commands execute with the privileges and environment of the invoking user.

Impact Assessment

The downloaded script re ...[truncated 574 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the remote shell-script installation method and prefer a trusted package manager with a pinned, reviewed release.
2. If a script installer must remain available, pin its URL to a specific immutable Git commit rather than main.
3. Publish the expected SHA-256 digest through an independently trusted release channel and verify it before execution.
4. Prefer cryptographic signature verification using a documented maintainer signing key.
5. Fail closed when verification fails; do not present manual visual inspection as the primary integrity control.
6. Document the installer's expected filesystem changes, network destinations, and privilege requirements.
7. Recommend installation in an isolated environment or unprivileged user context and explicitly warn users not to execute it with sudo.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Third-Party Installation Commands Do Not Pin Reviewed Versions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-35
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code:

bash

**Homebrew (macOS/Linux):**
```bash
brew tap holon-run/homebrew-tap
brew install uxc

Install Script (macOS/Linux, review before running):

bash

curl -fsSL https://raw.githubusercontent.com/holon-run/uxc/main/scripts/install.sh -o install-uxc.sh
less install-uxc.sh
bash install-uxc.sh

Cargo:

bash

cargo install uxc

text

### Technical Analysis

The Homebrew and Cargo instructions install externally maintained dependencies without pinning an audited version. The Homebrew tap is also a third-party source controlled outside this project. Consequently, the installed package may differ over time from the version originally reviewed by the Skill's maintainers.

Package managers improve distribution safety but do not eliminate publisher-account compromise, malicious updates, unsafe package build behavior, or repository compromise. The instructions provide no expected version, checksum, signature, lock enforcement, or provenance requirements.

The remote shell-script option in the same installation section carries the separate and more direct remote-execution risk described above. Collectively, these choices make the Skill's setup dependent on mutable third-party state.

Installing `uxc` is necessary only when the prerequisite is absent. Automatically or routinely obtaining the newest unverified release exceeds the minimum dependency acquisition needed to operate the Skill.

### Attack Path

1. An attacker compromises the crate publisher, Homebrew tap, upstream release process, or another relevant dependency distribution account.
2. The attacker publishes a malicious or backdoored version of `uxc` or changes the package definition.
3. A user runs `brew install uxc` or `cargo install uxc` without specifying a revi
...[truncated 986 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin uxc to a specifically reviewed release for each installation method.
2. For Cargo, specify an exact reviewed version and use lock enforcement where supported.
3. For Homebrew, document a trusted versioned formula or bottle and verify its published checksum and provenance.
4. Identify which distribution channel is official and discourage installation from unnecessary alternative sources.
5. Verify release signatures or attestations before installation where the upstream project provides them.
6. Maintain a documented update-review process before changing the recommended version.
7. State that installation is unnecessary when a verified compatible uxc binary is already available.
8. Run the dependency with ordinary user permissions and restrict its network access to the documented DeepWiki endpoint where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill is for interacting with DeepWiki MCP to ask questions about GitHub repositories and read repository documentation. However, the provided code chunk only validates local project files and documentation conventions for the skill itself. Its primary purpose is CI/configuration validation, not repository inquiry or documentation retrieval through DeepWiki MCP. This is a material mismatch in actual behavior versus declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send repository names and free-form questions to a third-party network service without clearly warning that these inputs leave the local environment. This can lead to unintended disclosure of sensitive repository identifiers, internal project names, or confidential prompts, especially if users assume the skill operates locally or only against GitHub.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.