ClawHub
Back to skill

Security audit

Deepseek R1 Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a DeepSeek API guide with expected remote API examples and local deployment commands, not a skill that secretly runs code or persists access.

Before installing or following the examples, treat DeepSeek API calls as sending your prompts and API key to a third-party provider, avoid pasting secrets or regulated data, store real keys outside shell history, and pin/verify packages such as `vllm` in a virtual environment or container for production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:120
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 120
Vulnerability Type: Unpinned and unverified Python dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install vllm

Technical Analysis

The deployment guide instructs users to install vllm without specifying an reviewed version, cryptographic hashes, a lockfile, or a trusted package index. Consequently, the package and its transitive dependencies are resolved from mutable repository state at installation time.

Python package installation may execute package-controlled build or installation logic. If the package repository, a future package release, the configured index, or a transitive dependency is compromised, following this instruction could execute attacker-controlled code. The project contains no evidence that the current vllm package is malicious; this finding concerns avoidable supply-chain exposure created by the installation method.

Attack Path

  1. An attacker compromises a future release of vllm, one of its transitive dependencies, or a package index used by the victim.
  2. A user follows the documented deployment instruction and runs pip install vllm.
  3. pip resolves the latest compatible packages from the mutable index without validating project-approved versions or hashes.
  4. Malicious build, installation, or imported runtime code executes in the user's environment.
  5. The payload operates with the privileges and access available to the account that invoked pip.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on the installation context, this could expose local files, API credentials, model data, environment variables, and accessible network services. If installation is performed by an administrator or inside a privileged production environment, the impact may extend to system-level compromise or compromise of the deployed inference service.

Remediation
View remediation

Remediation Suggestions

  • Pin vllm to a reviewed, explicitly approved version instead of resolving the latest release.
  • Use a requirements or lock file that also constrains transitive dependencies.
  • Generate and verify cryptographic hashes, such as with pip install --require-hashes -r requirements.txt.
  • Explicitly configure a trusted package index and avoid unreviewed extra indexes.
  • Recommend installation inside a dedicated virtual environment or container under a non-privileged account.
  • Add a dependency update process that includes vulnerability scanning, provenance review, and testing before changing pinned versions.

For example:

bash
python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

The corresponding requirements.txt should contain an approved version and its verified hashes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language instructions and descriptions consistently force Chinese as the interaction language, and there is no indication that this is optional or limited to a China-specific audience. Under the policy, a fixed language without user opt-in is a locale/language policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes multiple examples that send prompts and API keys to a third-party remote endpoint (api.deepseek.com) but provides no privacy, retention, or data-handling warning. In an agent-skill context, users may paste proprietary code, internal documents, or secrets into these examples without understanding that the content leaves their environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The curl example demonstrates direct transmission of user-supplied content and a bearer API credential to an external service. Although expected for an API integration guide, the lack of cautionary language makes accidental disclosure of sensitive prompts, source code, or production tokens more likely in real use.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

print(chunk.choices[0].delta.content, end="")

text

### Node.js / curl
```bash
curl https://api.deepseek.com/chat/completions \
  -H "Authorization: Bearer sk-xxx" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The explicit external endpoint reference confirms data transmission to a third-party service, which is relevant in a skill that may be followed by developers handling confidential content. The risk is contextual rather than inherently malicious: the skill normalizes outbound transmission without documenting trust, retention, or compliance considerations.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Node.js / curl

bash
curl https://api.deepseek.com/chat/completions \
  -H "Authorization: Bearer sk-xxx" \
  -H "Content-Type: application/json" \
  -d '{"model":"deepseek-chat","messages":[{"role":"user","content":"hello"}]}'

Static analysis

No suspicious patterns detected.