T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:13- Finding
Overly Broad Tool Permissions Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
Chat DeepSeek by Browser
Security checks for vulnerabilities and agentic risk
Overview
The skill mainly automates DeepSeek chat, but it also forwards login QR-code screenshots through messaging channels and requests broad command and file authority without tight scoping.
Review this skill before installing. Use it only if you are comfortable sending prompts to DeepSeek and letting the skill operate a logged-in browser profile. Avoid forwarding login QR codes through messaging channels; prefer scanning directly in the browser. The publisher should narrow tool permissions, remove automatic QR screenshot forwarding, and add explicit confirmation and destination checks for any outbound message.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:169- Finding
Shell Command Injection Risk in Messaging Command Construction
- Content
View full analysis
" --text "DeepSeek QR Code Login - Please scan with WeChat" --file "/path/to/screenshot.jpg"' }); await exec({ command: 'openclaw message send --channel whatsapp --target -m "DeepSeek QR Code Login - Please scan with WeChat" --media "/snapshot/screenshot.jpg"' }); await exec({ command: 'openclaw message send --channel signal --target -m "DeepSeek QR Code Login - Please scan with WeChat" --file "/path/to/screenshot.jpg"' }); ``` ### Technical Analysis The documented implementation constructs complete shell command strings and expects placeholders such as `` and `` to be replaced with runtime values. The WhatsApp and Signal account identifiers are not quoted. A value containing whitespace or shell metacharacters could therefore introduce additional arguments, redirections, pipelines, command substitutions, or additional commands. The iMessage example surrounds the identifier with double quotes, but double quotes do not safely neutralize every shell construct, including command substitution, if untrusted content is inserted without escaping. The workspace and file paths are also embedded in shell command strings. If they are replaced with paths containing quote characters or shell syntax, they can create a similar injection condition. The finding applies to the documented execution pattern. The reviewed project does not contain a concrete implementation that validates these values, uses an argument-array process API, or otherwise establishes that substitution is safe. ### Attack Path 1. An attacker influences an account identifier, channel target, workspace value, or genera ...[truncated 1281 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions operationalize forwarding a live login QR code through plain-language messaging workflows, which exposes authentication material outside the intended trust boundary. A forwarded QR image can be intercepted, misrouted, retained by messaging providers, or abused by unintended recipients, enabling account compromise or unauthorized session establishment.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs operators to capture a login QR code and relay it over external messaging channels for scanning. Authentication bootstrapping material should not be redistributed because it broadens who can access it, undermines channel integrity, and can enable unauthorized session creation if intercepted or sent to the wrong target.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to send user prompts to chat.deepseek.com, yet its description does not clearly warn that user content will be transmitted to a third-party AI service. This creates a privacy and data-handling risk, especially if users assume the skill only performs local browser automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The QR-login workflow includes sending screenshots and messages via third-party channels, but the skill description does not clearly disclose this behavior to the user up front. That lack of transparency prevents informed consent for cross-channel transmission of potentially sensitive authentication-related content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs taking a DeepSeek login QR-code screenshot and forwarding it over external messaging channels such as iMessage, WhatsApp, and Signal. Even if intended to help the user complete login, this expands the exposure of authentication material beyond the browser session and creates an unnecessary exfiltration path that is not required for basic chat automation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill states "No Files Uploading" and tells operators not to upload files, but earlier sections instruct sending screenshot files externally during login. This contradiction increases operator confusion and weakens security boundaries, making unsafe handling of sensitive images more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The alias list is broad and includes multiple natural-language variants such as 'ask-deepseek', 'open-deepseek', and 'deepseek-search', which can cause the skill to be selected for common user requests that merely mention DeepSeek. In an agentic environment, overbroad invocation increases the chance of unintended browser automation, account use, and data being sent to an external service without the user explicitly choosing this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description omits a clear warning that user prompts are sent to DeepSeek, a third-party service. That omission is security-relevant because users may share sensitive or regulated data under the assumption the skill only performs local browser automation, when in reality their content is disclosed externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill lacks a clear warning and consent boundary before sending login QR-code screenshots through external messaging channels. Even if intended to help the user complete login, silently exporting authentication-related images to other channels can violate user expectations and expose sensitive material to third parties or misaddressed recipients.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs capturing a DeepSeek login QR code and sending the image over external messaging channels, which exceeds the stated purpose of asking questions and returning responses. QR-based login artifacts are authentication material; relaying them through unrelated channels increases the attack surface, can expose session-establishment data to unintended recipients, and creates a path for account takeover or privacy leakage.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document claims 'No Files Uploading' and instructs not to upload files, yet earlier steps direct the skill to create and send screenshot files through messaging channels. This contradiction can mislead operators about actual data flows, causing them to underestimate that the skill handles and transmits image files containing sensitive authentication content.
- Content