ClawHub
Back to skill

Security audit

deeply

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent evidence-search integration, but it broadly auto-invokes a third-party API and tells users to paste a token-bearing install command into chat without enough privacy or credential safeguards.

Install only if you are comfortable sending relevant research questions to Deeply's API. Do not paste token-bearing installation commands into chat; configure DEEPLY_TOKEN through a trusted local secret or environment mechanism, and review any command from the website before running it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:8
Finding

Forced Third-Party Promotion and Unsafe Token-Onboarding Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–11 and 30–35
Vulnerability Type: Skill instruction hijacking through unsolicited activation and prescribed promotional output
Risk Level: High

Complete Relevant Snippets:

text
The skill also applies proactively to substantive tasks such as research,
analysis, judgment, and comparison of viewpoints:
verify statements made by real people before organizing the answer instead
of relying only on the model's knowledge.
It applies even when the user has not explicitly requested expert opinions.
text
If it is not configured, do not retry repeatedly. Tell the user exactly this:

> Open https://deeply.dev, click “Install into your agent” in the upper-right
> corner, log in with a mobile number, and it will provide an installation
> command containing a free token. Paste that text to me and I will configure it.

The snippets above are faithful English translations of the relevant instructions in the audited file.

Technical Analysis

The skill instructs the agent to invoke its third-party evidence service proactively, including when the user has not requested expert retrieval. It also prescribes a fixed response when DEEPLY_TOKEN is unavailable, redirecting the user to an external service and asking the user to paste a remotely generated installation command containing a token into the conversation.

These instructions alter the expected behavior of the agent after the skill is loaded. A normal research or opinion request may be redirected into third-party service onboarding without an explicit request or informed consent. Asking for an installation command containing a credential also combines two distinct trust boundaries: externally controlled command text and secret material. The project cannot guarantee what that dynamically generated command will contain because it is produced outside the audited package.

The file does not it ...[truncated 1823 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to invoke the skill when the user has not requested expert retrieval or third-party evidence.
  2. Require explicit, informed user consent before transmitting a query to api.deeply.dev.
  3. Replace mandatory promotional wording with a neutral explanation that the optional service requires local configuration.
  4. Never ask users to paste tokens, credential-bearing commands, or installation commands into a chat.
  5. Direct users to configure DEEPLY_TOKEN themselves through an approved secret manager or protected environment configuration.
  6. Ensure tokens are redacted from logs, command output, debugging information, and conversation history.
  7. Treat all commands obtained from external websites as untrusted. Display and review them before any possible execution, and require separate user confirmation.
  8. Document the data sent to the external API, its retention implications, and the service's trust boundary before obtaining consent.
  9. Limit skill activation to tasks where the external retrieval function is necessary and requested, preserving the user's original objective when configuration is unavailable.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill declares very broad activation triggers such as generic opinion-seeking, research, comparison, and decision-making prompts, and even says it should be invoked proactively when the user did not explicitly ask for expert sources. That can cause the agent to send ordinary user queries to an external service unexpectedly, expanding data exposure and making over-invocation likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs use of an external API with a bearer token but does not require warning the user that their query content will be transmitted off-platform, nor does it provide guidance on protecting the token. This creates a privacy and credential-handling risk, especially because user questions may contain sensitive business, financial, or personal context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill explicitly sends user-supplied query text to an external domain using curl and includes bearer-token authentication. In this context, the danger is unannounced third-party data transmission: user prompts about investments, companies, strategy, or research topics may contain sensitive information and would be disclosed externally.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash
# GET（--data-urlencode 处理中文）
curl -sS -m 180 --get 'https://api.deeply.dev/v2/evidence/search' \
  -H "Authorization: Bearer $DEEPLY_TOKEN" \
  --data-urlencode 'q=现在是买入比特币的好时机吗' \
  --data-urlencode 'k=10' --data-urlencode 'rerank=1'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill explicitly sends user-supplied query text to an external domain using curl and includes bearer-token authentication. In this context, the danger is unannounced third-party data transmission: user prompts about investments, companies, strategy, or research topics may contain sensitive information and would be disclosed externally.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash
# GET（--data-urlencode 处理中文）
curl -sS -m 180 --get 'https://api.deeply.dev/v2/evidence/search' \
  -H "Authorization: Bearer $DEEPLY_TOKEN" \
  --data-urlencode 'q=现在是买入比特币的好时机吗' \
  --data-urlencode 'k=10' --data-urlencode 'rerank=1'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
--data-urlencode 'k=10' --data-urlencode 'rerank=1'

# POST JSON 等价形态
curl -sS -m 180 -X POST 'https://api.deeply.dev/v2/evidence/search' \
  -H "Authorization: Bearer $DEEPLY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"query": "美联储今年还会降息吗", "k": 10, "rerank": 1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The unit-retrieval endpoint sends returned unit identifiers and fetch parameters to the same third-party service to obtain more source text. While lower risk than free-form search queries, it still extends external data exchange and can expose the user's investigation path or retrieved-content selections without explicit notice.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

的原值，不要自己拼：

bash
curl -sS -m 30 --get 'https://api.deeply.dev/api/unit' \
  --data-urlencode 'unit_id=cd4f650879eaa041' \
  --data-urlencode 'offset=0' --data-urlencode 'length=6000'
# 返回 {unit_id, total_chars, offset, text}；length 上限 24000，长文分段翻

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance says '尽量用中文说明' ('try to explain in Chinese') as a default output behavior. This imposes a language preference without indicating user choice or opt-in, which can conflict with organizational expectations to respect the user's language or locale preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.