Security audit

Deepaistudy Errors

Security checks for vulnerabilities and agentic risk

Overview

This study tool appears legitimate, but it needs review because it uploads student work, stores reusable credentials in plaintext, and advertises controls that are not actually enforced.

Review before installing. Use it only if you are comfortable sending worksheet photos and extracted study content to the configured DeepAIStudy server. Avoid uploading pages with names, school identifiers, grades, or other personal data, and do not rely on --preview or --count to prevent upload or saving. Be aware that the password is stored locally in plaintext and that delete operations may remove remote records immediately.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The CLI advertises --preview and --count controls, but cmd_add ignores them and always submits images for ingestion and saves all detected errors. This is dangerous because users may rely on the preview-only or limited-add semantics to avoid uploading/storing sensitive educational content, leading to unintended data disclosure and integrity-impacting actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs users to upload photos of student error worksheets for AI analysis but does not warn that these images may contain sensitive student information and will be transmitted to a remote service. In an education context, this increases privacy risk because homework, names, grades, or other personal data may be exposed or retained without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation shows configuring a username and plaintext password directly in CLI commands without any warning about shell history, local config storage, or secret handling. This can lead to credential exposure through terminal history, screenshots, shared machines, or insecure configuration files, especially since credentials are reused across another skill.

Missing User Warnings

Medium

Confidence: 77% confidence
Finding: The skill documents a delete command with no warning that deletion may be permanent, affect synced remote records, or lack confirmation. While not a classic security exploit, it creates a safety and integrity risk because users may accidentally destroy educational records or uploaded student materials.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The tool stores the password in plaintext in ~/.config/deepaistudy-prep/config.ini with no warning, encryption, or secure credential storage. If the local account, backups, or filesystem permissions are exposed, the user's service credentials can be recovered and reused.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The add workflow transmits local image files to a remote API, but the CLI does not provide an explicit warning or consent step even though those images may contain sensitive student data. In this skill context, educational worksheets and error notebooks can include personal information, making silent upload behavior more privacy-sensitive than a generic file utility.

Static analysis

No suspicious patterns detected.