Langchain Skill Vmisep 2026

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:06 AM UTC
• Version: 1.0.0

Overview

This appears to be a real LangChain assistant, but it needs review because it sends prompts to external AI providers and includes a credential-like API key in source.

Review before installing. Avoid sending secrets, personal data, or proprietary material unless you are comfortable with Google Gemini and DeepSeek processing the prompts. The publisher should remove and rotate the embedded DeepSeek key, load credentials from user-controlled environment variables, clearly disclose provider data flows, offer provider selection or local routing, and pin all dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: langchain_skill.py:26
• Finding: Hard-Coded DeepSeek API Credential in Source Code<![CDATA[ ## Vulnerability Details **File Location**: `langchain_skill.py`, lines 26–33 **Vulnerability Type**: Hard-coded secret **Risk Level**: High ### Vulnerable Code ```python if "deepseek" in selected_model: llm = OpenAI( openai_api_base="https://api.deepseek.com/v1", openai_api_key="sk-e7ec5...39506694", # key DeepSeek của Sếp model_name="deepseek-chat", temperature=0.7, max_tokens=1500 ) ``` ### Technical Analysis An API-key-like value is embedded directly in the source code. Secrets committed to a project can be recovered by anyone who can read the package, repository, build artifacts, backups, or source history. The displayed value contains an ellipsis and may be truncated or inactive. Therefore, the audit cannot establish that it is currently usable. Nevertheless, placing credential material directly in source code is an insecure credential-management practice and may reveal portions of a real credential. ### Attack Path 1. An attacker obtains a copy of the skill package, repository, build artifact, or source history. 2. The attacker reads `langchain_skill.py` and extracts the embedded credential value. 3. If the value or an earlier version of it is valid, the attacker submits authenticated requests to the configured DeepSeek endpoint. 4. The requests consume the credential owner's quota and may incur charges until the credential is revoked or restricted. ### Impact Assessment If the embedded value corresponds to a valid credential, an attacker could obtain the API privileges assigned to that key. The likely scope is unauthorized DeepSeek API use, quota exhaustion, billing abuse, and possible access to provider-side resources available to the key. This finding does not establish local system compromise or privilege escalation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the credential from the source code and repository history. - Revoke and rotate any real credential associated with the exposed value. - Read the key from a protected environment variable or secret manager, for example `DEEPSEEK_API_KEY`. - Refuse to initialize the DeepSeek client when the secret is absent rather than falling back to an embedded value. - Apply provider-side restrictions, spending limits, monitoring, and alerting. - Add secret scanning to pre-commit hooks and continuous integration. - Ensure logs and exception messages never disclose secret values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: langchain_skill.py:9
• Finding: Every User Query Is Disclosed to an Additional External LLM Provider<![CDATA[ ## Vulnerability Details **File Location**: `langchain_skill.py`, lines 9–35 **Vulnerability Type**: Uncontrolled external disclosure of user input **Risk Level**: Medium ### Vulnerable Code ```python def run_langchain_skill(query: str) -> str: # Router ưu tiên DeepSeek cho query tiếng Việt router_prompt = PromptTemplate( input_variables=["query"], template="""Phân loại query sau: Nếu là tiếng Việt hoặc code/reasoning → chọn 'deepseek'. Nếu cần context dài, multimodal hoặc tiếng Anh → chọn 'gemini'. Chỉ trả lời 'deepseek' hoặc 'gemini' (không giải thích). Query: {query}""" ) router_llm = ChatGoogleGenerativeAI(model="gemini-1.5-flash") router_chain = LLMChain(llm=router_llm, prompt=router_prompt) selected_model = router_chain.run(query=query).strip().lower() # Chọn LLM dựa trên router if "deepseek" in selected_model: llm = OpenAI( openai_api_base="https://api.deepseek.com/v1", openai_api_key="sk-e7ec5...39506694", # key DeepSeek của Sếp model_name="deepseek-chat", temperature=0.7, max_tokens=1500 ) model_name = "DeepSeek-chat" else: llm = ChatGoogleGenerativeAI(model="gemini-1.5-flash") model_name = "Gemini 1.5 Flash" ``` ### Technical Analysis The complete user query is sent to Google Gemini to select a model. If Gemini selects DeepSeek, the same query is subsequently included in the main prompt and sent to DeepSeek. Consequently, selecting DeepSeek does not prevent disclosure to Google. The implementation has no local routing, consent check, sensitive-data detection, redaction, provider allowlist, or option to disable the preliminary Gemini request. The project documentation mentions automatic routing but does not clearly explain that every query is first transmitted to Gemini. ### Attack Path 1. A user invokes the skill with confidential, regulated, proprietary, or personally identifiabl ...[truncated 914 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace LLM-based routing with deterministic local routing where feasible. - Clearly disclose every external provider that can receive user content. - Obtain explicit consent before transmitting content to multiple providers. - Add a configuration option that limits processing to one approved provider. - Detect and redact secrets, credentials, personal data, and other sensitive content before external transmission. - Support provider allowlists and organization-specific data-residency policies. - Minimize routing input by sending only locally derived metadata rather than the complete query. - Document provider retention and training policies and configure enterprise privacy controls where available. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:29
• Finding: Unpinned and Incomplete Third-Party Dependency Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Unsafe dependency management **Risk Level**: Low ### Vulnerable Code ```text - Yêu cầu: Cần venv với langchain đã cài (pip install langchain langchain-community langchain-core). ``` ### Technical Analysis The installation command resolves mutable package versions from the configured Python package index without a lockfile, exact version constraints, or cryptographic hashes. This makes installations non-reproducible and allows future package releases to alter the code executed by the skill. The instructions are also incomplete relative to the implementation, which imports `langchain_google_genai` and `langchain_text_splitters`. Users may consequently install additional packages manually without reviewed version constraints. No evidence was found that the named packages are deliberately malicious or typosquatted. The risk arises from unconstrained supply-chain resolution and ad hoc dependency installation. ### Attack Path 1. A user follows the documented `pip install` command. 2. Pip resolves whichever package versions are current or available from the configured index at installation time. 3. A compromised, malicious, or incompatible future release is selected because no reviewed version or hash is enforced. 4. Package installation hooks or imported runtime code execute with the privileges of the user running the installation or skill. This exploitation path is conditional on compromise of a dependency, package index, publishing account, or local package-source configuration. ### Impact Assessment A compromised dependency could execute code with the privileges of the Python environment's user, potentially reading accessible files, environment variables, and API credentials or making network requests. The current project itself does not request elevated privileges, so the direct scope is limited to the installing or executing user's existing permissions. ...[truncated 3 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Provide a reviewed lockfile or requirements file containing exact versions. - Use cryptographic hashes and install with hash verification, such as `pip install --require-hashes`. - Declare every runtime dependency, including the packages that provide `langchain_google_genai` and `langchain_text_splitters`. - Install dependencies in an isolated virtual environment under a non-privileged account. - Use a trusted package index or controlled internal mirror. - Run dependency vulnerability, provenance, and license scans in continuous integration. - Review and deliberately update locked dependencies on a controlled schedule. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains a hardcoded DeepSeek API key directly in source code, which is a real secret exposure. Anyone with code access can reuse the credential for unauthorized API calls, incur cost, access associated account resources, and propagate the secret through logs, repos, or model-generated output.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A sensitive API credential is embedded in the code with no warning or disclosure, which creates direct secret leakage risk. In this context, the skill has no legitimate reason to expose a reusable provider credential in source, so the finding is a true and serious vulnerability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises conversation memory but does not clearly warn that prior messages in the session are retained and reused. This creates a privacy risk because users may disclose sensitive information without realizing it can persist in memory and influence later outputs.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The description says the skill supports answering "bằng tiếng Việt," which reads as a fixed language behavior rather than an option the user can choose. Under the language policy, forcing a specific language without opt-in is a natural-language policy concern.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger guidance is inconsistent ('langchain <query>' and 'langchain: <query>') and broad enough that a host system may invoke the skill unexpectedly when users casually mention the keyword. Unintended invocation can expose conversation contents to the skill and increase the chance of unauthorized processing of user input.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Telling users to continue chatting with the same keyword 'langchain' is overly broad and may cause the skill to capture unrelated prompts across a session. In a skill with memory, accidental activation is more dangerous because retained context may be reused or disclosed in later responses.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The description mentions future web search and external API integrations without warning that user data may be transmitted to third-party services. Even if framed as extensibility, this normalizes off-system data flows without consent language or handling guidance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sends user input to Gemini for routing and may later send the query and chat history to Gemini or DeepSeek without any visible consent, notice, or policy disclosure. This is dangerous because users may provide sensitive data under the assumption processing is local, while the code actually forwards content to third-party services.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Chọn LLM dựa trên router
    if "deepseek" in selected_model:
        llm = OpenAI(
            openai_api_base="https://api.deepseek.com/v1",
            openai_api_key="sk-e7ec5...39506694",  # key DeepSeek của Sếp
            model_name="deepseek-chat",
            temperature=0.7,

• Confidence: 88% confidence
• Finding: The code transmits data to an external API endpoint at api.deepseek.com, which is a real external data egress path. In this skill, that path becomes more sensitive because user queries and potentially summarized conversation context are sent off-box, and the same codebase also contains an exposed credential.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The system prompt instructs the assistant to always respond in Vietnamese, which imposes a specific language policy on all users. The file does not offer opt-in/choice or explain a justified region-specific constraint, so this is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The comment suggests benign internal prompt caching, but the implementation actually transmits user queries and summarized chat history to external LLM providers. This mismatch can mislead reviewers and users about where data goes, increasing the risk of unintentional disclosure of sensitive prompts or conversation context.

Static analysis

No suspicious patterns detected.