T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:42- Finding
Prompt Injection Through Chained LLM Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
GEO Performance Analysis DeepSeek
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says: it sends brand and category inputs to DeepSeek for GEO analysis and returns a report, with no persistence or local privilege behavior found.
Before installing, confirm you are comfortable sending brand names, category keywords, and generated analysis text to DeepSeek and incurring API costs. Use non-sensitive inputs, consider pinning dependencies in a lock file, and treat the generated GEO conclusions as advisory because prompt injection can affect LLM-based judgments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Versions
- Content
View full analysis
=1.0.0 pydantic>=2.0.0 python-dotenv>=1.0.0 ``` ### Technical Analysis All dependencies use open-ended lower-bound constraints. A future installation can therefore resolve package versions that were not reviewed with this project, including future major versions. This reduces build reproducibility and increases exposure to compromised releases, unexpected transitive dependencies, or incompatible API changes. `python-dotenv` is listed but is not imported or used by the audited implementation. Keeping an unnecessary package expands the dependency and transitive supply-chain attack surface without providing functionality. No evidence in the audited files establishes that the currently named packages are malicious. The issue is the unsafe dependency-resolution policy rather than a confirmed compromised package. ### Attack Path 1. A user or deployment process runs `pip install -r requirements.txt`. 2. The package index resolves the newest versions satisfying the open-ended constraints. 3. A newly compromised, behaviorally incompatible, or otherwise unreviewed release is downloaded. 4. Package installation or later import executes code from that release in the installer or application security context. 5. The affected dependency can alter application behavior or access resources available to that Python process. This path depends on a malicious or vulnerable future dependency release or compromised distribution channel; none was identified in the audited snapshot. ### Impact Assessment Impact depends on the privileges of the account performing installation or running the Skill. A compromised dependency could potentially access the API key, network, files, and other resources available to that process. If dependencies are installed with eleva ...[truncated 260 chars]- Remediation
View remediation
=` constraints. 2. Generate a lock file that also pins transitive dependencies. 3. Use hash verification, such as `pip install --require-hashes`, to ensure downloaded artifacts match approved distributions. 4. Remove `python-dotenv` because the audited implementation does not use it, or document and implement its intended purpose. 5. Run automated dependency vulnerability and provenance checks in CI. 6. Upgrade dependencies through an explicit review process and test updates before changing the lock file. 7. Install packages in an isolated virtual environment under a non-privileged account. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions and usage guidance are presented in Chinese throughout the skill file, while the file does not state that the skill is China-specific or that users may choose another language. This can amount to forcing a specific language without user opt-in, which matches the policy category for language or locale violations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases are broad enough to match ordinary user questions about brand visibility or recommendation behavior, which can cause the skill to activate when the user did not explicitly consent to sending brand/category data to an external API. In this skill, unintended activation is more concerning because execution causes outbound transmission to DeepSeek and incurs token costs, creating privacy and cost risks rather than direct code-execution risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill transmits user-supplied inputs and model-generated content to a third-party external API endpoint (DeepSeek). This creates a real data exposure boundary: sensitive brand names, category terms, and generated analysis text leave the local trust boundary, and if operators assume local-only processing, confidential data could be disclosed to an external service.
- Content
python # 初始化 OpenAI 客户端，Base URL 指向 DeepSeek API client = OpenAI( api_key=api_key, base_url="https://api.deepseek.com/v1" ) try:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code contains a natural-language instruction requiring the model to generate the report in Chinese ("使用中文"). Under the policy, forcing a specific language without user opt-in is a locale/language policy violation, and there is no alternative language option or justification shown in the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill's behavior and user interaction in that language, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. This creates a natural-language locale policy concern because it implicitly fixes the interaction language without opt-in or justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified with a lower bound only, which allows future incompatible or vulnerable releases to be installed and makes builds non-reproducible. In a security-sensitive agent skill, this weakens supply-chain control and can unexpectedly introduce vulnerable package versions.
- Content
text openai>=1.0.0 pydantic>=2.0.0 python-dotenv>=1.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Using pydantic>=2.0.0 leaves resolution open to any later release, including versions affected by known advisories or future regressions. Because pydantic commonly processes untrusted input, an unsafe resolved version could expose the skill to denial-of-service or parsing-related issues.
- Content
text openai>=1.0.0 pydantic>=2.0.0 python-dotenv>=1.0.0
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The manifest does not pin pydantic, and the package has known advisories, so the actual installed version may be vulnerable without any visibility from this file alone. Given pydantic's role in parsing and validating input, an affected version could enable denial-of-service or other parser-related abuse when handling attacker-controlled data.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The unpinned python-dotenv dependency permits installation of arbitrary later versions, making it impossible to guarantee that known-vulnerable releases are excluded. Since dotenv tooling may read or modify local configuration files, version drift can increase the risk of file-handling vulnerabilities affecting the runtime environment.
- Content
text openai>=1.0.0 pydantic>=2.0.0 python-dotenv>=1.0.0
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
python-dotenv has known advisories, and because the requirement is unpinned, there is no assurance that installations will avoid affected releases. If the skill uses dotenv file-writing or file-resolution features, a vulnerable version could contribute to local file overwrite or unsafe file access scenarios.
- Content
Static analysis
No suspicious patterns detected.