Deep Validator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 2.5.2

Overview

This skill performs a legitimate hosted validation service, but it can send emails, URLs, domains, and uploaded contact files to a third-party service before the user has clearly approved that data sharing.

Install only if you are comfortable sending validation inputs to the hosted operator. Do not use it for secrets in URLs, internal hostnames, regulated data, or bulk contact files unless the user explicitly approves third-party processing; prefer self-hosting for sensitive datasets and pin dependencies if using the optional local MCP setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:133

Finding

Unpinned Third-Party Dependencies in Local MCP Installation Instructions

Content

View full analysis

Remediation

View remediation

" "httpx==" ``` 2. Publish a complete lock file that includes transitive dependencies. 3. Generate and verify package hashes, and install with `pip --require-hashes`. 4. Document the expected trusted package index and prevent fallback to untrusted indexes. 5. Include the referenced `mcp_server.py` and dependency manifests in the audited artifact. 6. Run the MCP server under a dedicated, minimally privileged account or container. 7. Avoid exposing the administrative bypass key to the MCP process unless strictly necessary. Prefer a narrowly scoped credential that cannot globally bypass billing. 8. Add automated dependency scanning and controlled update review to the release process. ]]>

other

Note

• Location: SKILL.md:610

Finding

Contradictory Classification Pricing and Consent Documentation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

Run

bash

cp .env.example .env
# Fill X402_WALLET_ADDRESS, BASE_RPC_URL, MPP_TEMPO_RECIPIENT, MPP_SECRET_KEY

pip install -r requirements.txt

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README encourages use of a hosted endpoint for validating emails, URLs, domains, and files, but it does not prominently disclose that user-supplied data is transmitted to a third-party internet service operated by an external party. In an agent skill context, this can cause sensitive inputs to be exfiltrated off-platform without informed consent, especially when agents may pass user data automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The example shows POSTing an email address to a remote hosted service, confirming actual external transmission of user data. In isolation this is expected functionality, but in an agent skill it is security-relevant because agents may forward private or regulated data to a third-party endpoint, creating confidentiality and compliance risks if users are not clearly informed.

Content

Scanner excerpt · README.md (reported line 110)May include surrounding context.

bash

# Free quote (no auth, no charge)
curl -X POST https://.../validate/email \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "confirmed": false}'
# → 200 { item_count: 1, total_cost: 0.0005, ... }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The invocation guidance is broad enough to encourage use whenever emails or URLs appear in ordinary workflows, increasing the chance that user-supplied addresses, links, contact lists, or sensitive URLs are transmitted to a third-party service unnecessarily. In this skill context, that matters because the service performs live external checks and the document itself admits URLs, hostnames, file uploads, and contact data may transit to the operator before validation protections apply.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This endpoint sends an email address to an external hosted service, which is a real data exfiltration boundary even when framed as validation. In this skill's context, that is materially sensitive because email addresses are personal data, and the document acknowledges third-party processing and that some information may appear in operator logs.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

bash

# Step 1 — get a free cost quote (no auth required, confirmed=false by default)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/email" \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "confirmed": false}'
# → HTTP 200: {"confirmed_required":true,"item_count":1,"cost_per_item":0.0005,"total_cost":0.0005,"currency":"USD","message":"...Resend with confirmed=true to proceed."}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This endpoint transmits URLs to an external service, and URLs can contain secrets, tokens, internal hostnames, or private-resource references. The skill context makes this more dangerous because the document explicitly states the URL reaches the operator before SSRF checks run, so sensitive paths or query strings may be disclosed even when later blocked.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

bash

# Step 1 — free cost quote (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/url" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "confirmed": false}'
# → HTTP 200: cost quote

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Bulk email validation transmits multiple addresses to a third-party operator, amplifying privacy and compliance risk compared with a single-item call. In this context, the skill specifically encourages processing lists and files, so a mis-invocation could expose entire contact datasets without strong necessity or user understanding.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

bash

# Step 1 — free quote for N emails (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/emails/bulk" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["[e-mail]", "[e-mail]"], "confirmed": false}'
# → HTTP 200: {"item_count":2,"total_cost":0.0002,...}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Bulk URL validation sends many URLs externally, which can disclose browsing targets, internal systems, campaign links, or embedded secrets at scale. The skill context heightens the risk because it promotes redirect tracing and live reachability checks, making it easy to forward sensitive operational link inventories to the operator.

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

bash

# Step 1 — free quote (confirmed=false, no auth)
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/urls/bulk" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com", "https://example.org"], "confirmed": false}'
# → HTTP 200: {"item_count":2,"total_cost":0.0002,...}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Mixed bulk validation increases the chance of over-collection because both email addresses and URLs may be shipped together to the external service in one call. That combination can reveal richer personal or organizational context than either data type alone, especially if links and identities originate from the same workflow or file.

Content

Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.

bash

# Step 1 — free quote
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/mixed/bulk" \
  -H "Content-Type: application/json" \
  -d '{"items": ["[e-mail]", "https://example.com", "not-anything"], "confirmed": false}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Standalone domain validation transmits a domain to the hosted operator, which is still an external disclosure even if less sensitive than full URLs or email lists. In some environments, domains under evaluation can reveal prospective partners, internal projects, or targeting information, so the transmission can carry business sensitivity.

Content

Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.

bash

# Step 1 — free quote
curl -s -X POST "https://deep-validator-production.up.railway.app/validate/domain" \
  -H "Content-Type: application/json" \
  -d '{"domain": "acme.io", "confirmed": false}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

Even the free classification endpoint transmits user-provided email addresses to an external service, so the absence of billing does not remove the privacy risk. Because the skill encourages using classification first on large lists, it may normalize sending substantial datasets off-platform before the user appreciates the disclosure boundary.

Content

Scanner excerpt · SKILL.md (reported line 622)May include surrounding context.

bash

# Classify emails
curl -s -X POST "https://deep-validator-production.up.railway.app/batch/classify/emails" \
  -H "Content-Type: application/json" \
  -d '{"items": ["[e-mail]", "[e-mail]", "[e-mail]", "notanemail"]}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The 'Rules for agents' section tells agents to add ?webhook_url=https://... so the server will POST job completion updates, but neither async file endpoint's documented query parameters include webhook_url; those sections only describe polling via GET /jobs/{job_id}. This is an active documentation contradiction about how async job completion is handled, not merely an omission, because one part says webhooks are a supported mechanism while the endpoint docs define only polling parameters.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The auto-detection rules hard-code French terms like 'courriel', 'adresse', and later 'lien' as recognized column names. This introduces a locale-specific behavior in natural-language configuration without documenting user choice, opt-in, or regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The URL file-upload documentation lists 'lien' as an auto-detected URL column alias, which reflects a specific locale choice in the natural-language behavior description. The file does not explain this as optional multilingual support or provide a user-facing locale selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description limits the skill's purpose to validating email addresses and URLs, with examples centered on DNS MX, DNSBL, disposable-domain detection, HTTP reachability, and redirect tracing. The file later documents a separate /validate/domain capability that qualifies domains directly, which is adjacent but broader than the stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.