Security audit

Links Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This link automation skill appears legitimate, but it can fetch links automatically, send transcript text to DeepSeek, and save or upload results without a clear confirmation step.

Install only if you want pasted links to be processed by an automated pipeline and you are comfortable with extracted article text or video transcripts being saved locally, potentially uploaded through your COS configuration, and sent to DeepSeek when configured. Avoid using it for private, regulated, proprietary, or copyrighted content unless you add explicit confirmation, review the storage configuration, and understand which credentials and destinations will be used.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill behavior includes sending content to an external model service (`DeepSeek API`) and writing artifacts locally, but the description does not clearly disclose these data flows. This creates a transparency and consent problem: linked content, transcripts, or extracted text may be transmitted or stored outside the user’s expected boundary.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The script reaches outside its immediate processing role by invoking host-installed tools and implicitly relying on host credential/config files such as ~/.cos.conf. In an agent skill context, this broadens trust boundaries: a workflow handling untrusted content can trigger data movement using ambient machine credentials, increasing the blast radius if the skill is misused or compromised.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad enough that normal conversation containing a link or phrases like '处理这个链接' could automatically activate downloading and processing logic. In a skill that performs network retrieval, transcription, and routing, unintended activation can cause unapproved data collection, external requests, and storage actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description does not warn users that linked content may be automatically downloaded, transcribed, extracted, and potentially processed by external services. This lack of notice increases the risk of users inadvertently submitting sensitive or copyrighted material for processing without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script sends the full transcript content to DeepSeek's external API, which can expose sensitive or proprietary audio-derived text to a third party. In this pipeline context, transcripts may contain private conversations, account data, or unpublished material, and the code provides no disclosure, consent gate, redaction step, or data-classification check before transfer.

Static analysis

No suspicious patterns detected.