Security audit

DeutschlandGPT

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for a real DeutschlandGPT/OOMOL integration, but it should be reviewed because it under-describes external generation/data-processing actions and recommends an unverified pipe-to-shell installer.

Review before installing. Use it only when you intentionally want DeutschlandGPT/OOMOL connector calls, avoid sending sensitive text unless appropriate for that service, and prefer verifying or manually reviewing the oo CLI installer instead of running the pipe-to-shell command blindly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install the CLI via 'curl ... | bash', which executes a remotely fetched script without prior verification. If the install endpoint, network path, or hosting infrastructure is compromised, this can lead to arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest claims the skill is for 'searching and reading data,' but the documented actions include chat completion and embedding generation, which are inference/compute operations rather than simple read-only access. This mismatch can mislead downstream agents or users about the skill’s capabilities and trust boundaries, increasing the chance of unintended invocation or unsafe assumptions about side effects and data handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase 'Use this skill for ANY DeutschlandGPT request' is overly broad and can cause the skill to be selected for a wide range of loosely related prompts. Over-broad routing increases the chance of unnecessary external data sharing, accidental tool use, or bypassing more appropriate built-in handling and narrower skills.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The safety section says untagged actions are reads, but the listed untagged actions create outputs such as chat completions and embeddings. Labeling non-read operations as 'safe to run directly' can cause an agent to invoke content-generation or data-processing actions without proper scrutiny, user awareness, or policy checks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.