Security audit

DeepLink Agentic

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a real-estate research workflow, but it handles account tokens and public task sharing in ways that could expose user data or credentials.

Install only if you trust agentic.dichanai.com with your real-estate prompts, uploaded files, task history, and bearer token. Avoid running share on sensitive tasks, treat printed NEW_TOKEN values as secrets, rotate any token exposed in logs or transcripts, and verify updates independently rather than replacing files from an unverified URL.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agentic.py:108
Finding: Renewed Bearer Token Disclosed Through Standard Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party Dependency Creates a Non-Reproducible Supply Chain
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/agentic.py:448
Finding: Update Workflow Trusts an Unverified Server-Provided Download URL
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a domain-specific real-estate research assistant, but the documented behavior includes broader account, token, task, file, scheduling, update-checking, and public-sharing operations. This mismatch can mislead users into granting trust or providing data under narrower expectations, while the skill actually exposes substantially more control over remote resources and data lifecycle.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The token-check and renewal flow performs credential management outside the stated research scope and retrieves fresh bearer tokens through the CLI. Bundling credential lifecycle operations into a research skill increases the risk of misuse, especially in agentic contexts where a tool may be called automatically and expose or mishandle credentials.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The share command makes a task public and constructs a share URL without any interactive warning, confirmation, or scope check. Research tasks may contain sensitive prompts, uploaded files, or generated outputs, so a single command can unintentionally disclose confidential information to anyone with the link.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The share operation is a high-risk disclosure action but the CLI executes it immediately with no confirmation or warning about public exposure. In the context of a research skill that handles uploaded documents and generated reports, this makes accidental data leakage significantly more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes code with access to environment variables and networked APIs but does not declare an explicit tool scope or allowed-tools policy. That weakens transparency and policy enforcement, making it harder for users and the host platform to understand and constrain what the skill can access, especially since it handles tokens and remote task execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill instruction set is written as mandatory operational guidance in Chinese and does not provide any opt-in or alternative language behavior for users. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to send the user's complete request verbatim to an external service. Because user prompts can contain confidential business data, personal information, credentials, or internal instructions, verbatim forwarding increases the risk of unnecessary disclosure to a third party; the danger is amplified here because the service is remote and the skill encourages complex long-form research requests that may include sensitive attachments and context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Natural-language strings throughout the CLI, including the top-level description and command help, are fixed to Chinese with no option for the user to select another locale. That constitutes a language policy concern because the skill enforces a specific language rather than offering choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The renewed bearer token is printed directly to stdout as NEW_TOKEN, which can be captured by shell history, terminal logs, CI logs, process supervisors, or screen sharing. Anyone who obtains that token may impersonate the user until expiry and access account data and operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI exposes capabilities beyond the stated deep-research scope, including task deletion, sharing, renaming, token renewal, and broader account/task administration. This scope expansion increases the blast radius of the skill: if invoked by an agent or user without clear understanding, it can modify account state or expose data rather than merely create, monitor, and retrieve research outputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.