DeepRead Agent Self Sign Up

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 PM UTC
• Version: 2.1.0

Overview

The setup flow is mostly coherent, but it includes a document upload verification step that is omitted from its own endpoint disclosure.

Review this before installing if you only want authentication setup. Use a non-sensitive test PDF if you run the verification step, and treat DEEPREAD_API_KEY as a secret; prefer a secrets manager for long-term storage and avoid printing or committing it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · device_flow.py (reported line 85)May include surrounding context.

python

echo "Approved! DEEPREAD_API_KEY is set for this session."
echo ""
echo "To persist across sessions (your choice):"
echo "  Option 1 (recommended): Store in a secrets manager (OS keychain, 1Password CLI, pass)"
echo "  Option 2: Manually add 'export DEEPREAD_API_KEY=\"...\"' to ~/.zshrc"
echo ""
echo "The key value is in \$DEEPREAD_API_KEY — use 'echo \$DEEPREAD_API_KEY' to see it."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · device_flow.sh (reported line 76)May include surrounding context.

sh

echo "Approved! DEEPREAD_API_KEY is set for this session."
echo ""
echo "To persist across sessions (your choice):"
echo "  Option 1 (recommended): Store in a secrets manager (OS keychain, 1Password CLI, pass)"
echo "  Option 2: Manually add 'export DEEPREAD_API_KEY=\"...\"' to ~/.zshrc"
echo ""
echo "The key value is in \$DEEPREAD_API_KEY — use 'echo \$DEEPREAD_API_KEY' to see it."

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs use of shell commands, environment-variable handling, and outbound network access, but it does not declare explicit tool scope such as permissions or allowed-tools. This creates a governance gap where an agent may execute higher-risk capabilities without clear sandboxing or user-consent boundaries, increasing the chance of unintended secret handling or network actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

Agent requests device code → User opens URL in browser → User approves → Agent receives API key

text

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Step 1: Request a Device Code

bash

curl -s -X POST https://api.deepread.tech/v1/agent/device/code \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "my-ai-agent"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This duplicate finding identifies the same file-upload behavior to /v1/process. Because the setup skill handles authentication, adding document upload makes the context more dangerous by encouraging external transmission of local content under the guise of simple key verification.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

Submit a test document to confirm the key is valid:

bash

curl -s -X POST https://api.deepread.tech/v1/process \
  -H "X-API-Key: $DEEPREAD_API_KEY" \
  -F "file=@test.pdf"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This duplicate finding identifies the same file-upload behavior to /v1/process. Because the setup skill handles authentication, adding document upload makes the context more dangerous by encouraging external transmission of local content under the guise of simple key verification.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

Submit a test document to confirm the key is valid:

bash

curl -s -X POST https://api.deepread.tech/v1/process \
  -H "X-API-Key: $DEEPREAD_API_KEY" \
  -F "file=@test.pdf"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

# 2. Poll for token
while true; do
  TOKEN_RESPONSE=$(curl -s -X POST https://api.deepread.tech/v1/agent/device/token \
    -H "Content-Type: application/json" \
    -d "{\"device_code\": \"$DEVICE_CODE\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The statement that no other endpoints are contacted is contradicted by the earlier /v1/process upload instruction. While not an exploit primitive by itself, this misleading disclosure weakens user awareness of outbound data flows and can conceal unexpected document transmission in practice.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
| `https://api.deepread.tech/v1/agent/device/code` | POST | None | Request device code + user code |
| `https://api.deepread.tech/v1/agent/device/token` | POST | None | Poll for API key after user approval |
| `https://www.deepread.tech/activate` | — | Browser | User opens this URL to enter the code and approve |

**No other endpoints are contacted by this skill.**

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document claims that no other endpoints are contacted, but earlier instructions invoke the /v1/process endpoint. This inaccurate disclosure can mislead reviewers and users about the skill's actual network behavior, undermining trust and making it easier for unintended data transfer to occur without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · device_flow.py (reported line 78)May include surrounding context.

python

def store_api_key(api_key: str) -> None:
    """Store the API key as an environment variable for the current session only.

    Does NOT write to disk. The user can persist it manually using a
    secrets manager (recommended) or their shell profile.
    """
    os.environ["DEEPREAD_API_KEY"] = api_key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · device_flow.sh (reported line 22)May include surrounding context.

sh

# Step 1: Request device code
# POST /v1/agent/device/code — body: {"agent_name": "..."} (optional)
echo "Requesting device code..."
DEVICE_RESPONSE=$(curl -s -X POST "${API_BASE}/v1/agent/device/code" \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "clawdhub-agent"}')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · device_flow.sh (reported line 49)May include surrounding context.

sh

# POST /v1/agent/device/token — body: {"device_code": "..."}
# Returns: api_key (once, on approval) or error string
while true; do
  TOKEN_RESPONSE=$(curl -s -X POST "${API_BASE}/v1/agent/device/token" \
    -H "Content-Type: application/json" \
    -d "{\"device_code\": \"${DEVICE_CODE}\"}")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · device_flow.sh (reported line 69)May include surrounding context.

sh

fi
done

# Step 3: Store as environment variable (current session only — does not write to disk)
export DEEPREAD_API_KEY="$API_KEY"
unset API_KEY  # Clear the temporary variable
echo ""

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as an authentication/setup flow, but it also instructs the agent to upload a local file to the OCR processing endpoint to validate the key. This scope expansion matters because it changes the skill from credential setup into data transmission, which can cause unexpected exfiltration of document contents if the user or runtime assumes the skill only performs auth.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.