Security audit

Chat DeepSeek by Browser

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to automate DeepSeek chat, but it also handles login QR codes, personal contact data, messaging channels, and the user's main browser profile in ways that need careful review.

Install only if you are comfortable with a skill that can attach to your browser, send your prompts to DeepSeek, capture login QR screenshots, and use local messaging tools. Before use, prefer an isolated browser profile, avoid forwarding login QR codes through messaging apps, remove broad shell/network/file permissions, and require explicit confirmation of any recipient.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:499
Finding: Authentication QR Code Distributed Across Unverified Messaging Channels
Content: View full analysis
' + screenshotPath + '"' }); console.log("✅ QR Code sent via QQBot"); } catch (e) { console.log("⚠️ QQBot not available:", e.message); } ``` Sending the QR code to the session that initiated the request may be necessary. Broadcasting it over several independently configured ...[truncated 1504 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:520
Finding: Shell Command Injection Through Concatenated Recipient and File Path Values
Content: View full analysis
' + screenshotPath + '"' }); } catch (e) { console.log("⚠️ QQBot not available:", e.message); } ``` The refreshed screenshot path is handled in the same unsafe manner: ```javascript const newScreenshotPath = newScreenshotResult.path; try { await exec({ command: 'imsg send --to "' + userPhone + '" --text "QR code refreshed - please scan again with WeChat" --file "' + newScreenshotPath + '"' }); } catch (e) {} ``` Quoting a value inside a command string does not make it safe. If a value contains a quote followed by shell syntax, it can terminate the intended argument and introduce additional commands. `DEEPSEEK_PHONE` is environment-controlled, and the documentation also permits configuration-derived values. Screenshot paths are less directly controllable but are still inserted into the same shell c ...[truncated 1148 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:18
Finding: Attachment to the User's Primary Authenticated Chrome Profile
Content: View full analysis
**Important for OpenClaw >= v3.13:** Use direct Chrome attachment > (`profile: "user"`) instead of the relay extension. ``` ```javascript const result = await browser({ action: "open", profile: "user", url: "about:blank" }); await browser({ action: "navigate", profile: "user", targetId: result.targetId, url: "https://chat.deepseek.com/" }); ``` It also permits listing and focusing tabs: ```javascript const tabs = await browser({ action: "tabs", profile: "user" }); await browser({ action: "focus", profile: "user", targetId: "1" }); ``` The documentation acknowledges the security-relevant difference: ```markdown | Feature | `profile: "user"` | `profile: "openclaw"` (legacy) | | Login state | Uses your logged-in Chrome | Fresh browser session | ``` Users are instructed to enable remote debugging for that browser instance. This grants automation access to a profile that may contain unrelated tabs, active sessions, cookies, autofill data, and privileged web applications. The declared task requires access only to DeepSeek, so control over the primary browser profile violates least privilege. ### Attack Path 1. The user follows the Skill's instructions and enables remote debugging in the primary Chrome instance. 2. The Agent attaches using `profile: "user"`. 3. The browser interface exposes tab-listing, focus, navigation, DOM evaluation, and screenshot functionality. 4. Malicious instructions, compromised upstream content, or an Agent error direct those capabilities toward an unrelated authenticated tab. 5. The Agent reads displayed data, captures screenshots, performs actions ...[truncated 532 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:13
Finding: Tool Allowlist Grants Unnecessary Package Execution, Network, and Filesystem Access
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:766
Finding: Unnecessary Access to General User Profile Data for Recipient Discovery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level skill description says it opens DeepSeek and logs in, but omits the critical fact that the workflow may capture login QR-code screenshots and forward them through messaging channels. Users cannot meaningfully consent to that behavior without being told, and QR artifacts are authentication-sensitive.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill expands from simple browser automation for querying DeepSeek into cross-channel messaging and contact-handling behavior, including sending login QR screenshots over iMessage, WhatsApp, and QQBot. That materially broadens the data flow and attack surface: sensitive authentication artifacts and user-identifying contact data can be forwarded to third-party channels unrelated to the core task, creating privacy, account-takeover, and misdelivery risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These instructions direct sending QR-code screenshots to external channels but provide no strong privacy/safety guardrails, no destination verification, and no explicit consent checkpoint. Because login QR codes can enable authentication workflows, forwarding them outside the current session creates a serious risk of interception, misrouting, or unauthorized account access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to capture login QR screenshots and transmit them using external messaging tools with configured user contact data. This is a direct sensitive-data exfiltration pathway: authentication material is collected from the browser and pushed to external services, increasing exposure to interception, wrong-recipient delivery, and abuse.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The retry loop refreshes and re-sends login QR images until success, compounding the exposure of sensitive authentication material across time and channels. Repeated automated transmission increases the chance of leakage, stale-code confusion, accidental delivery to unintended recipients, and persistent abuse of user contact data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description advertises simple DeepSeek chat automation but omits that the workflow may capture login QR screenshots and send them through external channels. This prevents informed consent and disguises a materially more sensitive behavior involving authentication artifacts and personal messaging data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The direct Chrome guidance encourages use of the user's logged-in browser profile and remote debugging without a prominent warning about the sensitivity of that access. In this context, attaching to a live personal browser can expose cookies, open tabs, authenticated sessions, and other private browsing data beyond DeepSeek.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow explicitly describes sending login QR codes over multiple channels yet does not provide a strong, prominent warning before doing so. Because QR codes are part of account authentication, silent or under-disclosed redistribution significantly raises privacy and account-security risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill invokes shell commands to send screenshots over iMessage, WhatsApp, and QQBot, which is a materially broader capability than the declared DeepSeek chat workflow. This creates an exfiltration path from browser content to external networks and local messaging clients, especially dangerous because the transmitted content is tied to login/authentication flow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims 'No LLM requests or processing' even though the entire skill is designed to submit prompts to DeepSeek, an external LLM service. This is a deceptive or misleading capability statement that can cause operators or users to make unsafe privacy decisions under false assumptions about where their data is sent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Reading a user's phone number from environment variables, USER.md, or config is not necessary to ask questions on DeepSeek and creates unjustified access to personal data. This can cause silent disclosure or misuse of contact information, especially when paired with automated outbound messaging behavior elsewhere in the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The automation repeatedly assumes specific English interface text such as "New chat", "DeepThink", and "Search" to locate controls. While there is one Chinese fallback string, the skill generally relies on English labels without documenting locale requirements or offering a user opt-in for a specific language setting.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The package metadata uses a broad description and multiple generic aliases such as "open-deepseek", "browse-deepseek", and "deepseek-search", which can cause the skill to be invoked for loosely related user requests. Because this skill opens a browser, logs into a third-party chat service, and forwards user prompts externally, accidental activation can lead to unintended data disclosure and unsafe delegation of user queries to an external site.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Very broad aliases increase the chance that the skill is triggered for generic browsing, chat, or search requests the user did not intend to route through this automation. In context, accidental invocation matters because the skill can access the user's browser profile and may initiate login-related workflows and external messaging behaviors.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented behavior expands beyond browser automation into exporting login QR-code screenshots through external messaging channels. That creates an unnecessary data flow involving authentication artifacts and user-linked communication endpoints, which can leak sensitive session material or disclose account/login state to unintended recipients.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The workflow states that login is automated via QR code scanning, and subsequent steps are specifically built around WeChat QR login messaging. This imposes a specific locale/platform path without user opt-in or justification that the skill is intended only for users in that ecosystem.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instructions prioritize WeChat-based QR login and channels such as QQBot, Feishu, and WeCom as part of the default flow. This bakes in a locale-specific workflow without presenting it as optional or region-specific, which can violate language/locale neutrality expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Collecting or reusing a phone number from environment/configuration is not necessary for the core stated purpose of submitting prompts to DeepSeek and reading responses. This adds handling of personal contact data and enables unsolicited outbound messaging, increasing privacy and misuse risk without clear justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phone-number configuration section instructs storage and reuse of personal contact information but does not provide an explicit privacy warning or lifecycle guidance. This increases the chance of unnecessary retention, accidental reuse for the wrong recipient, or leakage through logs/configuration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The description around L0284 presents the skill as simple browser automation with raw extraction only, but later sections document active control of DeepSeek-specific modes such as DeepThink and chat-state management. That extends behavior beyond the minimal framing of just forwarding user questions and extracting rendered text.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The note at L1464-L1469 explicitly instructs never to rely on fixed ref IDs because they are dynamic, yet earlier example code uses hardcoded refs such as ref: "e102" for typing into the chat input. This is an active contradiction between the guidance and the documented implementation examples.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.