ClawHub
Back to skill

Security audit

Deepseek Assistant Free

Security checks for vulnerabilities and agentic risk

Overview

This DeepSeek API guide is mostly purpose-aligned, but it requests broad read/write/command authority and has unclear data-flow and callback scoping.

Review before installing. Only use this skill when you intend to send prompts to DeepSeek, avoid sending secrets or private project data, and prefer granting only the minimum network/API capability needed instead of broad read/write/exec permissions. Treat callback URLs as unsafe unless the destination is explicitly trusted and validated.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:16
Finding

Overprivileged and Ambiguous Tool Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-23
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml
tools:
- - read
  - exec
homepage: https://skillhub.cn
pricing_tier: L3
pricing_model: per_use
suggested_price: 29.9
tools: ["read", "write", "exec"]

Technical Analysis

The Skill declares general-purpose read, write, and exec capabilities even though its stated functionality is limited to selecting a DeepSeek model and sending HTTPS requests to the DeepSeek API. Arbitrary filesystem write access is not required for this workflow, and unrestricted filesystem read access is broader than necessary. General command execution is also significantly more powerful than a constrained HTTP client.

The tools property is defined twice using different structures. Depending on how the Agent platform parses duplicate YAML keys, either declaration may override the other or produce inconsistent permission behavior. Under the broader interpretation, the Skill receives read, write, and command-execution access.

No instruction in the audited file directly attempts to exploit these permissions. Nevertheless, exposing them violates least-privilege principles and increases the consequences of malicious user input, prompt injection, or compromised remote model output.

The documented transmission of the API key in an Authorization header and user prompts in the request body to https://api.deepseek.com/v1/chat/completions is necessary for the declared remote-model functionality. It is not, by itself, evidence of covert exfiltration.

Attack Path

  1. An Agent loads the Skill and grants the declared read, write, and exec tools.
  2. The user submits attacker-controlled content, or an external model response contains instructions interpreted by the Agent as actionable.
  3. The injected instructions induce the Agent to i ...[truncated 906 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the duplicate tools declarations and retain one unambiguous, schema-valid declaration.
  2. Remove write, because the documented workflow does not require filesystem modification.
  3. Remove general filesystem read unless a specific, documented local input must be accessed. If reading is necessary, restrict it to explicitly approved paths.
  4. Replace unrestricted exec with a dedicated HTTPS request tool restricted to:
    • HTTPS only;
    • Hostname api.deepseek.com;
    • The required API path;
    • Expected HTTP methods and content types.
  5. If exec is unavoidable, allow only a fixed command template without shell interpolation and reject user-controlled command arguments.
  6. Require explicit user approval before transmitting prompts that may contain secrets or confidential data.
  7. Ensure API keys are retrieved from a scoped secret store or environment variable and are never included in logs, model-visible prompt content, callback payloads, or error messages.
  8. Remove the unused callback_url parameter or enforce an explicit destination allowlist before implementing callback delivery.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The display name and summary position the skill specifically as a Chinese assistant and emphasize Chinese conversation support, but the document does not clearly state that this is a locale-specific skill or offer any language-selection option. Under the language/locale policy, forcing a specific language without opt-in or justification can be a policy issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation/use description is extremely broad, covering generic AI-model use, agent orchestration, and LLM applications without tight scope constraints. Overbroad triggers increase the chance the skill is invoked in contexts where sensitive data is present, causing unintended external transmission or misuse of exec-enabled functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to send prompts and optionally provide a callback URL to an external service but does not prominently warn that user content may leave the local environment. In an agent context, this can expose source code, proprietary data, or secrets to third parties or create SSRF-style risk if callback URLs are accepted without strict validation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The curl example demonstrates direct transmission of prompt data and authorization material to an external API endpoint. Although normal for an API-integration skill, the absence of strong disclosure and handling guidance makes accidental data exfiltration more likely in real agent workflows.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

第二步：发送首次对话

bash
# 使用 curl 快速测试
curl https://api.deepseek.com/v1/chat/completions \
  -H "Authorization: Bearer $DEEPSEEK_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

bash
# 使用 curl 快速测试
curl https://api.deepseek.com/v1/chat/completions \
  -H "Authorization: Bearer $DEEPSEEK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill includes executable example code that sends user-supplied content to api.deepseek.com. In this skill's context, external transmission is expected, but it remains security-relevant because prompts may contain confidential code, internal documents, or secrets if users are not clearly warned and constrained.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
const apiKey = process.env.DEEPSEEK_API_KEY;
// ...
async function chat(message) {
  const resp = await fetch('https://api.deepseek.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${apiKey}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill includes executable example code that sends user-supplied content to api.deepseek.com. In this skill's context, external transmission is expected, but it remains security-relevant because prompts may contain confidential code, internal documents, or secrets if users are not clearly warned and constrained.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
const apiKey = process.env.DEEPSEEK_API_KEY;
// ...
async function chat(message) {
  const resp = await fetch('https://api.deepseek.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${apiKey}`,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill presents itself as a DeepSeek API integration, but its dependency section ambiguously states that the LLM API is provided by the agent platform. This can mislead operators about which provider receives prompts, credentials, and outputs, undermining informed consent, data-flow review, and security boundary validation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The guidance later says '禁止: 在代码、脚本、SKILL.md 中硬编码 API Key', but earlier the file shows 'export DEEPSEEK_API_KEY=sk-your-key-here' inside SKILL.md. While clearly a placeholder, this still contradicts the document's own blanket statement about not hardcoding keys in this file.

Content

No source excerpt is available for this finding.