DeepRead Agent Self Sign Up

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 PM UTC
• Version: 2.1.0

Overview

The setup flow is mostly coherent, but it includes a document upload verification step that is omitted from its own endpoint disclosure.

Review this before installing if you only want authentication setup. Use a non-sensitive test PDF if you run the verification step, and treat DEEPREAD_API_KEY as a secret; prefer a secrets manager for long-term storage and avoid printing or committing it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Credential Access

High

• Category: Privilege Escalation

Content

echo "Approved! DEEPREAD_API_KEY is set for this session."
echo ""
echo "To persist across sessions (your choice):"
echo "  Option 1 (recommended): Store in a secrets manager (OS keychain, 1Password CLI, pass)"
echo "  Option 2: Manually add 'export DEEPREAD_API_KEY=\"...\"' to ~/.zshrc"
echo ""
echo "The key value is in \$DEEPREAD_API_KEY — use 'echo \$DEEPREAD_API_KEY' to see it."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo "Approved! DEEPREAD_API_KEY is set for this session."
echo ""
echo "To persist across sessions (your choice):"
echo "  Option 1 (recommended): Store in a secrets manager (OS keychain, 1Password CLI, pass)"
echo "  Option 2: Manually add 'export DEEPREAD_API_KEY=\"...\"' to ~/.zshrc"
echo ""
echo "The key value is in \$DEEPREAD_API_KEY — use 'echo \$DEEPREAD_API_KEY' to see it."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands, environment-variable handling, and outbound network access, but it does not declare explicit tool scope such as permissions or allowed-tools. This creates a governance gap where an agent may execute higher-risk capabilities without clear sandboxing or user-consent boundaries, increasing the chance of unintended secret handling or network actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Agent requests device code  →  User opens URL in browser  →  User approves  →  Agent receives API key
```

1. Agent calls `POST https://api.deepread.tech/v1/agent/device/code` to get a `device_code` and `user_code`
2. Agent displays the `user_code` and a verification URL to the user
3. User opens the URL in their browser, logs in, and enters the code
4. Agent polls `POST https://api.deepread.tech/v1/agent/device/token` until the user approves

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 1: Request a Device Code

```bash
curl -s -X POST https://api.deepread.tech/v1/agent/device/code \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "my-ai-agent"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Submit a test document to confirm the key is valid:

```bash
curl -s -X POST https://api.deepread.tech/v1/process \
  -H "X-API-Key: $DEEPREAD_API_KEY" \
  -F "file=@test.pdf"
```

• Confidence: 97% confidence
• Finding: This duplicate finding identifies the same file-upload behavior to /v1/process. Because the setup skill handles authentication, adding document upload makes the context more dangerous by encouraging external transmission of local content under the guise of simple key verification.

External Transmission

Medium

• Category: Data Exfiltration

Content

Submit a test document to confirm the key is valid:

```bash
curl -s -X POST https://api.deepread.tech/v1/process \
  -H "X-API-Key: $DEEPREAD_API_KEY" \
  -F "file=@test.pdf"
```

• Confidence: 97% confidence
• Finding: This duplicate finding identifies the same file-upload behavior to /v1/process. Because the setup skill handles authentication, adding document upload makes the context more dangerous by encouraging external transmission of local content under the guise of simple key verification.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 2. Poll for token
while true; do
  TOKEN_RESPONSE=$(curl -s -X POST https://api.deepread.tech/v1/agent/device/token \
    -H "Content-Type: application/json" \
    -d "{\"device_code\": \"$DEVICE_CODE\"}")

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
| `https://api.deepread.tech/v1/agent/device/code` | POST | None | Request device code + user code |
| `https://api.deepread.tech/v1/agent/device/token` | POST | None | Poll for API key after user approval |
| `https://www.deepread.tech/activate` | — | Browser | User opens this URL to enter the code and approve |

**No other endpoints are contacted by this skill.**

• Confidence: 84% confidence
• Finding: The statement that no other endpoints are contacted is contradicted by the earlier /v1/process upload instruction. While not an exploit primitive by itself, this misleading disclosure weakens user awareness of outbound data flows and can conceal unexpected document transmission in practice.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document claims that no other endpoints are contacted, but earlier instructions invoke the /v1/process endpoint. This inaccurate disclosure can mislead reviewers and users about the skill's actual network behavior, undermining trust and making it easier for unintended data transfer to occur without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

def store_api_key(api_key: str) -> None:
    """Store the API key as an environment variable for the current session only.

    Does NOT write to disk. The user can persist it manually using a
    secrets manager (recommended) or their shell profile.
    """
    os.environ["DEEPREAD_API_KEY"] = api_key

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Step 1: Request device code
# POST /v1/agent/device/code — body: {"agent_name": "..."} (optional)
echo "Requesting device code..."
DEVICE_RESPONSE=$(curl -s -X POST "${API_BASE}/v1/agent/device/code" \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "clawdhub-agent"}')

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# POST /v1/agent/device/token — body: {"device_code": "..."}
# Returns: api_key (once, on approval) or error string
while true; do
  TOKEN_RESPONSE=$(curl -s -X POST "${API_BASE}/v1/agent/device/token" \
    -H "Content-Type: application/json" \
    -d "{\"device_code\": \"${DEVICE_CODE}\"}")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi
done

# Step 3: Store as environment variable (current session only — does not write to disk)
export DEEPREAD_API_KEY="$API_KEY"
unset API_KEY  # Clear the temporary variable
echo ""

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The skill is described as an authentication/setup flow, but it also instructs the agent to upload a local file to the OCR processing endpoint to validate the key. This scope expansion matters because it changes the skill from credential setup into data transmission, which can cause unexpected exfiltration of document contents if the user or runtime assumes the skill only performs auth.

Static analysis

No suspicious patterns detected.