GEO Performance Analysis

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 1.0.5

Overview

This skill performs the disclosed GEO brand-analysis task through DeepSeek API calls, with no evidence of hidden persistence, local data access, credential theft, or destructive behavior.

Install only if you are comfortable sending the brand name, category keyword, and generated analysis text to DeepSeek under your API key. Treat the report as advisory because crafted inputs can manipulate LLM-based conclusions, and prefer pinned dependencies or a reviewed lockfile before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:47

Finding

Indirect Prompt Injection in the Multi-Stage LLM Pipeline

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

=1.0.0 pydantic>=2.0.0 python-dotenv>=1.0.0 ``` The documented installation command in `SKILL.md` installs these open-ended dependency ranges: ```bash pip install -r requirements.txt ``` ### Technical Analysis Each dependency uses only a minimum version constraint. A future installation can therefore resolve to a release that was not reviewed with this project. This makes builds non-reproducible and increases exposure to upstream compromise, malicious package releases, or incompatible changes. The code does not import or use `python-dotenv`, so that package expands the dependency and supply-chain attack surface without supporting observed functionality. No evidence shows that the named packages are currently malicious. The confirmed weakness is the absence of exact, reviewed version constraints and integrity hashes, together with an apparently unused dependency. ### Attack Path 1. A developer or deployment process executes `pip install -r requirements.txt`. 2. The package index resolves each open-ended constraint to a currently available compatible release. 3. A compromised, malicious, or unexpectedly incompatible future release is selected. 4. Package installation or subsequent import executes that release with the privileges of the installation or runtime account. 5. Depending on the compromised package, the environment, API credentials, or application behavior could be affected. ### Impact Assessment The immediate finding does not itself grant privileges. If an upstream package or release channel is compromised, however, dependency code could execute with the same privileges as the user or service installing or running the skill. Potential scope could include: - Reading environment variables such as `DEEPSEEK_A ...[truncated 357 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content of the skill description, usage instructions, triggers, and safety notes is presented in Chinese, which effectively forces a specific language for users and integrators. The file does not offer an alternative language, user opt-in, or justification that this skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill sends user-supplied inputs and model-generated content to an external third-party endpoint (DeepSeek) for processing. This creates a real data exposure boundary: brand names, category keywords, and potentially sensitive prompt contents are transmitted off-platform, which can violate data-handling expectations or compliance requirements if not clearly disclosed and controlled.

Content

Scanner excerpt · main.py (reported line 36)May include surrounding context.

python

# 初始化 OpenAI 客户端，Base URL 指向 DeepSeek API
    client = OpenAI(
        api_key=api_key,
        base_url="https://api.deepseek.com/v1"
    )

    try:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt explicitly instructs the model to generate the report in Chinese ("使用中文") with no user opt-in or configurable language option. This is a natural-language locale policy issue because the skill imposes a specific language regardless of user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is written entirely in Chinese and does not indicate that the skill supports other languages or lets the user choose a locale. Under the policy, a language-specific constraint should be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specification uses a lower-bound range instead of an exact version pin, which makes builds non-reproducible and can allow unexpected upstream changes or vulnerable releases to be installed. In a security-sensitive agent skill, this weakens supply-chain control even if there is no immediate evidence of exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

openai>=1.0.0
pydantic>=2.0.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pydantic dependency is not pinned to a specific version, so installations may resolve to different releases over time, including versions with known security defects. This creates avoidable supply-chain risk and makes it impossible to verify whether deployed environments are using a safe release.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

openai>=1.0.0
pydantic>=2.0.0
python-dotenv>=1.0.0

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Pydantic has known advisories, and because the manifest does not pin a version, there is no way to determine whether the installed release is affected. The danger here is uncertainty: deployments may silently resolve to a vulnerable version, exposing consumers to issues such as denial of service depending on how the library is used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The python-dotenv package is specified with a broad minimum version rather than an exact reviewed version, which permits drift to potentially unsafe or untested releases. This is especially relevant because environment-file tooling can interact with sensitive configuration and filesystem paths.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

openai>=1.0.0
pydantic>=2.0.0
python-dotenv>=1.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Python-dotenv has known advisories, but the unpinned manifest prevents verification that a safe version will be installed. Because dotenv utilities may read or write environment files and interact with filesystem paths, unresolved version selection can increase risk if a vulnerable release is chosen.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.