ClawHub
Back to skill

Security audit

deepseek-balance

Security checks for vulnerabilities and agentic risk

Overview

The skill does its stated DeepSeek balance check, but it can send an Anthropic authentication token to DeepSeek if no DeepSeek key is set.

Review before installing or using. Use only a dedicated DEEPSEEK_API_KEY, do not rely on ANTHROPIC_AUTH_TOKEN, and rotate any Anthropic token if this skill was previously run without DEEPSEEK_API_KEY set.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:16
Finding

Cross-Service Disclosure of Anthropic Authentication Token

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` 3. Update the quick-execution command so it uses only `DEEPSEEK_API_KEY`: ```bash [ -z "${DEEPSEEK_API_KEY:-}" ] && echo "Please set DEEPSEEK_API_KEY first" || curl -sS -X GET 'https://api.deepseek.com/user/balance' \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DEEPSEEK_API_KEY}" | python3 -c 'import sys, json; data = json.load(sys.stdin); print(data)' ``` 4. Do not reuse credentials across unrelated providers, even as a compatibility fallback. 5. Document that the Skill requires only a DeepSeek-scoped API key. 6. Advise users who previously ran the Skill with only `ANTHROPIC_AUTH_TOKEN` configured to revoke or rotate that token and review associated account usage. 7. Consider using `curl --fail-with-body --show-error` and explicit HTTP-status handling in the quick command so authentication and network failures are not misrepresented as valid JSON responses. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
THROPIC_AUTH_TOKEN)
API_KEY="${DEEPSEEK_API_KEY:-$ANTHROPIC_AUTH_TOKEN}"

if [ -z "$API_KEY" ]; then
    echo "❌ 错误: 环境变量 DEEPSEEK_API_KEY 或 ANTHROPIC_AUTH_TOKEN 未设置"
    echo ""
    echo "请运行以下命令设置（以 DEEPSEEK_API_KEY 为例）："
    echo "export DEEPSEEK_API_KEY='your-deepseek-api-key'"
    echo ""
    echo "Linux/macOS 永久设置："
    echo "echo 'export DEEPSEEK_API_KEY=\"your-deepseek-api-key\"' >> ~/.bashrc"
    echo "source ~/.bashrc"
    echo ""
    echo "Windows (PowerShell): \$env:DEEPSEEK_API_KEY='your-deepseek-api-key'"
    exit 1
fi

echo "🔍 正在查询 DeepSeek API 余额..."

# 2. 发送请求并捕获 HTTP 状态码与响应体
RESPONSE=$(curl -s -L -w "\n%{http_code}" -X GET 'https://api.deepseek.com/user/balance' \
    -H 'Accept: application/json' \
    -H "Authorization: Bearer $API_KEY")

# 分离 HTTP 状态码和 Body
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
BODY=$(echo "$RESPONSE" | s

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

适用于终端快速检查，无需创建脚本文件，自动兼容环境变量：

bash
[ -z "${DEEPSEEK_API_KEY:-$ANTHROPIC_AUTH_TOKEN}" ] && echo "⚠️ 请先设置 DEEPSEEK_API_KEY 或 ANTHROPIC_AUTH_TOKEN" || curl -s -X GET 'https://api.deepseek.com/user/balance' -H "Authorization: Bearer ${DEEPSEEK_API_KEY:-$ANTHROPIC_AUTH_TOKEN}" | python3 -c "import sys,json; d=json.load(sys.stdin); b=d.get('balance_infos',[{}])[0] if d.get('is_available') else None; print(f\"✅ 总余额: {b['total_balance']} {b['currency']}\n🎁 赠送: {b['granted_balance']}\n💳 充值: {b['topped_up_balance']}\") if b else print('⚠️ 无可用余额')"

输出示例

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description, instructions, and all user-facing outputs are written in Chinese, with no indication that another language can be used or selected. The policy for this category flags language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is intended to query a DeepSeek balance, but it falls back to using ANTHROPIC_AUTH_TOKEN, causing a credential for one service to be transmitted to a different external service. This is a cross-service secret misuse issue that can leak a highly sensitive token to DeepSeek and violates least-privilege expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation does not explicitly warn users that their API credential will be transmitted to an external DeepSeek endpoint. In a skill context, omission of this disclosure increases the chance that operators unknowingly expose secrets or run the skill under broader credentials than intended.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
echo "🔍 正在查询 DeepSeek API 余额..."

# 2. 发送请求并捕获 HTTP 状态码与响应体
RESPONSE=$(curl -s -L -w "\n%{http_code}" -X GET 'https://api.deepseek.com/user/balance' \
    -H 'Accept: application/json' \
    -H "Authorization: Bearer $API_KEY")

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
echo "🔍 正在查询 DeepSeek API 余额..."

# 2. 发送请求并捕获 HTTP 状态码与响应体
RESPONSE=$(curl -s -L -w "\n%{http_code}" -X GET 'https://api.deepseek.com/user/balance' \
    -H 'Accept: application/json' \
    -H "Authorization: Bearer $API_KEY")