Security audit

fore-vip-ds-harness

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed DSH installer, but it makes persistent system and npm changes and runs unpinned external packages without clear confirmation gates.

Review this carefully before installing. Only proceed if you trust the DSH package source and are comfortable with global npm changes, desktop launcher creation, and possible sudo package installation. Prefer pinning package versions, using the official npm registry, avoiding npx -y, and asking the agent to show each command and file before it runs or writes anything.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:71
Finding: Unpinned npm Package Execution Through a Persistent Third-Party Registry
Content: View full analysis
Remediation: View remediation
``` 3. Verify the package's published integrity, provenance, maintainers, and expected repository before installation. 4. Prefer a project-local installation with a committed lockfile rather than a global installation. 5. Do not use `npx -y` for unreviewed packages because it combines automatic approval, retrieval, and immediate execution. 6. If a registry override is unavoidable, apply it only to the individual command: ```bash npm install --registry=https://registry.npmjs.org @deepseek-ai/dsh@ ``` 7. Preserve and restore the user's original npm registry configuration after any temporary change. 8. Obtain explicit user confirmation before downloading or executing third-party code. 9. Avoid elevated execution and ensure npm installation occurs under a least-privileged user account. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:73
Finding: Unverified Node.js Installer Fallback Uses a Non-Canonical Distribution Source
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 83% confidence
Finding: Chaining sudo apt update && sudo apt install -y nodejs npm compresses multiple privileged actions into one line, reducing opportunities for review, validation, or interruption between state-changing steps. In this skill, the chain is part of a larger automated setup flow that proceeds to registry changes and package execution, making the blast radius of a mistaken or malicious instruction larger.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
Linux：

bash
# 无 Node 时（按发行版二选一） sudo apt update && sudo apt install -y nodejs npm # Debian/Ubuntu # sudo dnf install -y nodejs npm # Fedora npm config set registry https://registry.npmmirror.com npm install -g @deepseek-ai/dsh

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match generic requests like local deployment or DeepSeek agent setup, which can cause the skill to activate in situations the user did not clearly intend. Since this skill performs installation, writes executable files, and configures the system, over-broad invocation increases the chance of unintended privileged or persistent changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation table routes broad requests such as 'help me install dsh' or 'local run DeepSeek Agent' directly into an execution flow. In context, that flow includes package installation, registry reconfiguration, service startup, and desktop shortcut creation, so ambiguity materially raises the risk of the agent taking impactful actions without sufficiently explicit consent.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill instructs use of sudo apt update && sudo apt install -y nodejs npm, which causes privileged system changes. While installing packages is a legitimate goal, embedding root-requiring commands in an automated skill is dangerous because it normalizes elevation and can lead to major host modification if the commands, repositories, or surrounding steps are wrong or later abused.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
Linux：

bash
# 无 Node 时（按发行版二选一） sudo apt update && sudo apt install -y nodejs npm # Debian/Ubuntu # sudo dnf install -y nodejs npm # Fedora npm config set registry https://registry.npmmirror.com npm install -g @deepseek-ai/dsh

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The commented sudo dnf install -y nodejs npm is also a privileged installation path. Even though it is an alternative example rather than the primary branch, it still instructs root package installation and contributes to a skill design that assumes elevated execution is acceptable.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
bash
# 无 Node 时（按发行版二选一） sudo apt update && sudo apt install -y nodejs npm # Debian/Ubuntu # sudo dnf install -y nodejs npm # Fedora npm config set registry https://registry.npmmirror.com npm install -g @deepseek-ai/dsh dsh --version

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill tells the agent to execute npx -y @deepseek-ai/dsh web without pinning a specific package version. That causes installation and execution of whatever version is current at runtime, creating a supply-chain risk if a bad release or compromised dependency is published. In this skill's context, the command is meant to run directly on the user's machine, which makes the risk more significant than a mere documentation reference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs the agent to create executable launcher files and desktop shortcuts on the user's machine without an explicit up-front warning that it will modify the desktop and add persistent launch artifacts. Creating executables in a high-visibility location increases social-engineering and persistence risk, especially because the files are generated dynamically at runtime rather than shipped as inspectable artifacts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The common-commands section repeats the unpinned npx -y @deepseek-ai/dsh web pattern, again instructing runtime download and execution of a mutable external package. Because the skill is specifically designed to guide live installation/execution, this is a real supply-chain exposure rather than a harmless example.
Content: No source excerpt is available for this finding.