ClawHub
Back to skill

Security audit

Deepseek WebSearch

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward web-search skill that sends search queries to RedFox/Deepseek using a user-provided API key, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending your search queries and REDFOX_API_KEY-authenticated requests to RedFox/Deepseek. Do not include secrets, private business data, personal information, or regulated data in searches, and consider using a revocable scoped API key and a virtual environment with pinned dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:45
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-49
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

bash
3. **安装依赖**

   ```bash
   pip3 install requests
   ```

Technical Analysis

The installation instructions install requests without pinning an audited version or verifying package integrity with cryptographic hashes. Consequently, pip resolves the package and its transitive dependencies from the user's configured package index at installation time.

Although requests is a legitimate package and no malicious dependency is present in the audited project, this installation method does not provide reproducible dependency resolution. A compromised package release, transitive dependency, or configured package index could cause users to install attacker-controlled code. The installed package is subsequently imported by scripts/deepseek_search.py at line 17.

Attack Path

  1. An attacker compromises a relevant package release, transitive dependency, or package index configured on the user's system.
  2. A user follows the documented pip3 install requests instruction.
  3. Pip resolves and installs the attacker-controlled artifact because no version or integrity hash is enforced.
  4. The user invokes scripts/deepseek_search.py.
  5. Python imports the installed package, allowing malicious package code to execute with the privileges of the user running the skill.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the invoking user's account. The resulting access could include reading or modifying files available to that account, accessing inherited environment variables such as REDFOX_API_KEY, and making network requests. The scope would be limited by the operating-system privileges and sandbox restrictions applied to the Python process.

No evidence was found that the current requests package or this project intentionally ...[truncated 24 chars]

Remediation
View remediation

Remediation Suggestions

  1. Declare dependencies in a dedicated requirements or lock file using an explicitly audited version.
  2. Record cryptographic hashes for all direct and transitive packages, and install them with:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  3. Generate and review the lock file through a controlled dependency-update process.
  4. Use a trusted package index explicitly and prevent unintended fallback to untrusted indexes.
  5. Run dependency vulnerability and provenance checks in CI before publishing updates.
  6. Execute the skill in a least-privileged virtual environment or sandbox and expose only the environment variables required for operation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tainted flow: 'headers' from os.environ.get (line 51, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deepseek_search.py (reported line 58)May include surrounding context.

python
# ── Step 1: 提交搜索 ──────────────────────────────────────────────
    try:
        submit_resp = requests.post(
            f"{API_BASE}/dsSubmit",
            json={"inquiryText": query},
            headers=headers,

Tainted flow: 'headers' from os.environ.get (line 51, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/deepseek_search.py (reported line 112)May include surrounding context.

python
time.sleep(POLL_INTERVAL)

        try:
            result_resp = requests.post(
                f"{API_BASE}/dsResult",
                json={"taskId": task_id},
                headers=headers,

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Describing the capability as 'one-click search' started from natural-language descriptions with no specific trigger constraints encourages generic activation. For a web-connected skill, this increases the chance that sensitive or incidental user text is sent to a third-party search provider when the user did not explicitly request tool usage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README says users can 'simply describe your search need in natural language' and gives very broad trigger examples, which makes invocation boundaries ambiguous. In an agent environment, overly generic activation phrasing can cause unintended tool use on ordinary conversation, leading to unnecessary external requests, privacy leakage in forwarded prompts, or misuse of a networked capability without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README defines invocation in very broad terms such as using natural-language search requests directly, with multiple generic trigger examples and no clear exclusions or routing boundaries. This can cause over-triggering of the skill on ordinary user messages, potentially sending unintended queries to an external web-search service and increasing privacy, consent, and data-exposure risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents use of an API key and external web access but does not declare any explicit tool scope or permissions boundary. This creates a mismatch between advertised behavior and enforced capability limits, increasing the risk of unintended environment-variable access or network use without clear review and consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are very broad and overlap with common user requests for ordinary web searching. That makes accidental invocation more likely, which can silently route user queries to this external service and expose sensitive prompts or data users did not intend to send outside the primary system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description emphasizes real-time search capability but does not clearly warn users that their queries may be transmitted to an external provider. This undermines informed consent and can lead to privacy, compliance, or data-handling issues when users submit sensitive requests believing the interaction is local.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The usage guidance says users can directly describe any search need in natural language, with no constraints on sensitive data, confirmation, or allowed query types. In context of a networked search skill, this increases the chance that confidential or regulated information is forwarded to a third-party service without adequate user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow explicitly directs the agent to send user-provided search text to a remote Deepseek API, but it does not disclose that the prompt content leaves the local environment or may be processed by a third party. This creates a privacy and data-handling risk because users may include sensitive information in search requests without informed consent, and the skill is specifically designed to forward arbitrary natural-language input externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains natural-language instructions and runtime messages entirely in Chinese, including the docstring usage guidance and error/help text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The skill transmits user-supplied search content to an external third-party endpoint, which creates a real data exposure boundary. In an agent environment, users may enter sensitive prompts or proprietary information, and this script provides no consent gate, sensitivity filtering, or destination transparency beyond code inspection.

Content

Scanner excerpt · scripts/deepseek_search.py (reported line 58)May include surrounding context.

python
# ── Step 1: 提交搜索 ──────────────────────────────────────────────
    try:
        submit_resp = requests.post(
            f"{API_BASE}/dsSubmit",
            json={"inquiryText": query},
            headers=headers,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The polling request sends the task ID to the same external service, which is a minor additional external transmission. The primary risk is not the task ID itself but the continued interaction with the third-party service as part of a workflow handling potentially sensitive searches.

Content

Scanner excerpt · scripts/deepseek_search.py (reported line 112)May include surrounding context.

python
time.sleep(POLL_INTERVAL)

        try:
            result_resp = requests.post(
                f"{API_BASE}/dsResult",
                json={"taskId": task_id},
                headers=headers,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing instructions, examples, and descriptions are written in Chinese, and the file does not indicate that the skill supports other languages or that Chinese-only operation is a deliberate, justified regional constraint. This can be a language/locale policy issue when users are not given an explicit language choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The workflow instructions and example invocation are entirely Chinese-language and imply a Chinese-only operating context, but there is no statement that the skill is region- or language-specific or that users may choose another language. This can be a natural-language policy concern when a skill effectively forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.