Langchain Skill Vmisep 2026

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:06 AM UTC
• Version: 1.0.0

Overview

This appears to be a real LangChain assistant, but it needs review because it sends prompts to external AI providers and includes a credential-like API key in source.

Review before installing. Avoid sending secrets, personal data, or proprietary material unless you are comfortable with Google Gemini and DeepSeek processing the prompts. The publisher should remove and rotate the embedded DeepSeek key, load credentials from user-controlled environment variables, clearly disclose provider data flows, offer provider selection or local routing, and pin all dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: langchain_skill.py:26

Finding

Hard-Coded DeepSeek API Credential in Source Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: langchain_skill.py:9

Finding

Every User Query Is Disclosed to an Additional External LLM Provider

Content

View full analysis

str: # Router ưu tiên DeepSeek cho query tiếng Việt router_prompt = PromptTemplate( input_variables=["query"], template="""Phân loại query sau: Nếu là tiếng Việt hoặc code/reasoning → chọn 'deepseek'. Nếu cần context dài, multimodal hoặc tiếng Anh → chọn 'gemini'. Chỉ trả lời 'deepseek' hoặc 'gemini' (không giải thích). Query: {query}""" ) router_llm = ChatGoogleGenerativeAI(model="gemini-1.5-flash") router_chain = LLMChain(llm=router_llm, prompt=router_prompt) selected_model = router_chain.run(query=query).strip().lower() # Chọn LLM dựa trên router if "deepseek" in selected_model: llm = OpenAI( openai_api_base="https://api.deepseek.com/v1", openai_api_key="sk-e7ec5...39506694", # key DeepSeek của Sếp model_name="deepseek-chat", temperature=0.7, max_tokens=1500 ) model_name = "DeepSeek-chat" else: llm = ChatGoogleGenerativeAI(model="gemini-1.5-flash") model_name = "Gemini 1.5 Flash" ``` ### Technical Analysis The complete user query is sent to Google Gemini to select a model. If Gemini selects DeepSeek, the same query is subsequently included in the main prompt and sent to DeepSeek. Consequently, selecting DeepSeek does not prevent disclosure to Google. The implementation has no local routing, consent check, sensitive-data detection, redaction, provider allowlist, or option to disable the preliminary Gemini request. The project documentation mentions automatic routing but does not clearly explain that every query is first transmitted to Gemini. ### Attack Path 1. A user invokes the skill with confidential, regulated, proprietary, or personally identifiabl ...[truncated 914 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:29

Finding

Unpinned and Incomplete Third-Party Dependency Installation Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill contains a hardcoded DeepSeek API key directly in source code, which is a real secret exposure. Anyone with code access can reuse the credential for unauthorized API calls, incur cost, access associated account resources, and propagate the secret through logs, repos, or model-generated output.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A sensitive API credential is embedded in the code with no warning or disclosure, which creates direct secret leakage risk. In this context, the skill has no legitimate reason to expose a reusable provider credential in source, so the finding is a true and serious vulnerability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises conversation memory but does not clearly warn that prior messages in the session are retained and reused. This creates a privacy risk because users may disclose sensitive information without realizing it can persist in memory and influence later outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill supports answering "bằng tiếng Việt," which reads as a fixed language behavior rather than an option the user can choose. Under the language policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger guidance is inconsistent ('langchain ' and 'langchain: ') and broad enough that a host system may invoke the skill unexpectedly when users casually mention the keyword. Unintended invocation can expose conversation contents to the skill and increase the chance of unauthorized processing of user input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Telling users to continue chatting with the same keyword 'langchain' is overly broad and may cause the skill to capture unrelated prompts across a session. In a skill with memory, accidental activation is more dangerous because retained context may be reused or disclosed in later responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description mentions future web search and external API integrations without warning that user data may be transmitted to third-party services. Even if framed as extensibility, this normalizes off-system data flows without consent language or handling guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user input to Gemini for routing and may later send the query and chat history to Gemini or DeepSeek without any visible consent, notice, or policy disclosure. This is dangerous because users may provide sensitive data under the assumption processing is local, while the code actually forwards content to third-party services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The code transmits data to an external API endpoint at api.deepseek.com, which is a real external data egress path. In this skill, that path becomes more sensitive because user queries and potentially summarized conversation context are sent off-box, and the same codebase also contains an exposed credential.

Content

Scanner excerpt · langchain_skill.py (reported line 27)May include surrounding context.

python

# Chọn LLM dựa trên router
    if "deepseek" in selected_model:
        llm = OpenAI(
            openai_api_base="https://api.deepseek.com/v1",
            openai_api_key="sk-e7ec5...39506694",  # key DeepSeek của Sếp
            model_name="deepseek-chat",
            temperature=0.7,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The system prompt instructs the assistant to always respond in Vietnamese, which imposes a specific language policy on all users. The file does not offer opt-in/choice or explain a justified region-specific constraint, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The comment suggests benign internal prompt caching, but the implementation actually transmits user queries and summarized chat history to external LLM providers. This mismatch can mislead reviewers and users about where data goes, increasing the risk of unintentional disclosure of sensitive prompts or conversation context.

Content

No source excerpt is available for this finding.