Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently helps agents query DeepWiki for public GitHub repository understanding and includes clear safeguards for private repositories and large requests.
Install this when you want an agent to use DeepWiki for public GitHub repository research. Do not use the public DeepWiki fallback for private repositories unless you have confirmed an approved private Devin/MCP path and understand what repository information will be sent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
List tools:
curl --location "https://mcp.deepwiki.com/mcp" \
--header "content-type: application/json" \
--header "accept: application/json, text/event-stream" \
--data '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
visibility_file="$(mktemp)"
trap 'rm -f "$visibility_file"' EXIT
visibility_http_code="$(curl -sS --location --max-time 15 --output "$visibility_file" --write-out '%{http_code}' \
"https://api.github.com/repos/$repo_name")" || {
printf '%s\n' '{"repositoryVisibility":"unknown","reason":"github-visibility-request-failed"}' >&2
exit 1
}
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
| Repository not found, private, or its visibility is uncertain | Verify the exact public GitHub `owner/repo` spelling and visibility before any public MCP call. | For private repositories, require an approved Devin account and Devin MCP integration; never send the repository name, URL, source, or metadata to public DeepWiki. |
| Tool names or schema no longer match the expected three capabilities | Re-run the bounded discovery once and inspect the returned tool names. | Report schema drift and use the direct public MCP procedure only when its standard tools are available and the repository is confirmed public. |
| Wiki structure is empty, sparse, or does not cover the needed subsystem | Ask one narrower `ask_question` naming the subsystem. | State that the generated wiki is incomplete and verify against repository source before making consequential claims. |
| Full wiki contents are too large or truncated | Stop the full-content request and retain the structure result. | Use `read_wiki_structure` plus focused `ask_question` calls; do not retry the same unbounded request. |
The natural-language content in the prompts and expected behavior is written to require responses in Traditional Chinese, but the file provides no opt-in or explanation that this skill is intentionally region- or locale-specific. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
No suspicious patterns detected.