Security audit

deepseek-web-search

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its install path and privacy wording need careful review before use.

Install only from a reviewed pinned commit or release, not the floating npx github command. Treat your DeepSeek API key as sensitive, expect it and your search queries to be sent to DeepSeek over HTTPS, and prefer a limited-use key with billing limits. Use the single-harness install flags if you do not want the skill copied into every supported agent directory.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:89
Finding: Recommended installation command executes mutable remote code
Content: View full analysis
Remediation: View remediation

other

Note

Location: README.md:55
Finding: Documentation falsely claims that the API key never leaves the machine
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
Run the bundled script from this skill's directory (where this `SKILL.md` lives):

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx github:mingzeng21/deepseek-web-search without pinning to a specific tag or commit. That causes code to be fetched and executed from a moving GitHub target, so if the repository is later compromised or changed maliciously, users could execute attacker-controlled code during install.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The npx github:... --claude example still executes code from an unpinned GitHub repository. Although the intent is convenience, the installation path exposes users to repository compromise, tag movement, or maintainer account takeover leading to arbitrary code execution on the local machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This is another unpinned npx github: install variant, changing only the target harness flag. The underlying issue remains remote execution of mutable GitHub-hosted code, which is a classic software supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The --skip-key example preserves the same unpinned remote code execution risk as the other npx github: examples. In the context of a skill installer that writes into agent skill directories, compromise could lead to persistence inside multiple AI harnesses as well as local credential theft.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 110)May include surrounding context.
md
> Install this skill: https://github.com/mingzeng21/deepseek-web-search.git The assistant clones the repo and drops it into the correct skills folder for you — Claude Code reads `~/.claude/skills/`, while Codex, Gemini CLI, and Copilot CLI read `~/.agents/skills/`. Restart your harness (or run `/reload-plugins` in Claude Code) and it's live. > **Note:** `~/.agents/skills/` is the cross-runtime alias shared by Codex, Gemini CLI, and Copilot CLI — install once, use in all three.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explains that queries are sent to DeepSeek's server-side web-search agent, but it markets this as a convenience feature without a clear privacy/data-handling warning. Users may input secrets, proprietary text, or regulated data without understanding that prompts and derived browsing activity are transmitted to and processed by a remote third-party service.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx github:mingzeng21/deepseek-web-search without pinning to a specific commit, tag, or released package version. That means the fetched installer code can change over time, so anyone who can modify the upstream repo or its dependency path could cause arbitrary code execution on users' machines at install time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This line again recommends executing a mutable GitHub-hosted package via npx github:... without version pinning. Because npx will download and run code immediately, a later repository change or compromise could transparently deliver malicious installer behavior to users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command variant still executes remote GitHub code through npx without an immutable version reference. The extra flag does not reduce the supply-chain risk: users remain exposed to arbitrary code changes in the source repository.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Like the other install examples, this npx github:... --skip-key form runs unpinned remote code. In a skill-installation context this is particularly sensitive because the installer writes into shared agent skill directories and may handle API-key setup, increasing the blast radius of a compromised upstream installer.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.zh-CN.md (reported line 110)May include surrounding context.
md
> 安装以下 skill：https://github.com/mingzeng21/deepseek-web-search.git 助手会自动 clone 仓库并放到对应的 skills 目录——Claude Code 读取 `~/.claude/skills/`，Codex、Gemini CLI、Copilot CLI 读取 `~/.agents/skills/`。重启（Claude Code 里也可用 `/reload-plugins`）即可生效。 > **注意：** `~/.agents/skills/` 是 Codex、Gemini CLI、Copilot CLI 共用的跨运行时目录——装一次，三个工具通用。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly requires network access and reads a secret from either config.json or the DEEPSEEK_API_KEY environment variable, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege problem: a host or reviewer cannot reliably tell from the manifest that the skill needs outbound network access and secret handling, which can enable unintended execution in broader-trust environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The installer explicitly instructs users to run npx github:mingzeng21/deepseek-web-search, which fetches and executes remote repository code without pinning to a commit or immutable release. If the repository is changed, compromised, or force-pushed, users may execute attacker-controlled code during installation, which is especially risky because this script writes files into user tool directories and handles API-key setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The help text repeats the same unsafe installation pattern by directing users to invoke npx github:..., reinforcing execution of unpinned remote code. While this line is documentation rather than executable logic, it still materially increases supply-chain risk by encouraging an installation method that can silently pick up malicious repository changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · search.mjs (reported line 8)May include surrounding context.
js
import { fileURLToPath } from 'url'; const __dirname = dirname(fileURLToPath(import.meta.url)); const API_URL = 'https://api.deepseek.com/responses'; const MODEL = 'deepseek-v4-flash'; const CONFIG_PATH = join(__dirname, 'config.json'); const DEFAULT_MAX_TOKENS = 8000;

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file documents prompting for a DeepSeek API key, reading DEEPSEEK_API_KEY, and saving the key to a local config.json, but it does not include a clear user warning about protecting the credential or avoiding committing the file. For markdown files, missing warnings about behaviors affecting privacy or sensitive data handling should be flagged when omitted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The placeholder value uses Chinese text ('在此填入你的DeepSeek_API_Key') as the only user-facing instruction in the file. This imposes a specific language on users without opt-in or any documented locale-specific justification, which matches the language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction string includes a fixed language policy: '中文提问用中文回答'. This is a natural-language locale constraint embedded in the code, and there is no visible opt-in or alternative language selection mechanism.
Content: No source excerpt is available for this finding.