ClawHub
Back to skill

Security audit

Deepseek Extract

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it extracts a user-provided DeepSeek shared conversation and saves it locally, with normal privacy and dependency-install caveats.

Use this only for DeepSeek share links you are allowed to access. Treat exported transcripts as potentially sensitive local files, choose the output path carefully, and delete or protect the file afterward. For stricter environments, install Playwright and Chromium in an isolated virtual environment or container and pin reviewed versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Playwright and Chromium Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–29
Vulnerability Type: Unpinned third-party package and executable browser dependency
Risk Level: Medium

Vulnerable Code

bash
pip install playwright
playwright install chromium

The same installation instructions also appear in README.md, lines 25–29.

Technical Analysis

The installation procedure retrieves the latest available Playwright package and Chromium browser binary without a version constraint, dependency lockfile, cryptographic hash verification, or explicit trusted-source restriction.

Consequently, the components installed by users can differ from those reviewed during this audit. Python package installation may execute package-controlled installation logic, while the downloaded browser is a locally executable binary. This creates a supply-chain trust boundary through which a compromised package registry, upstream release, transitive dependency, or browser distribution channel could introduce malicious code.

This finding concerns dependency integrity. The audited repository itself does not contain evidence of malicious payloads, credential theft, persistence, privilege escalation, or data exfiltration.

Attack Path

  1. An attacker compromises an upstream Playwright release, one of its dependencies, the package distribution channel, or the browser download infrastructure.
  2. A user or Agent follows the documented prerequisite commands.
  3. Because no reviewed version or artifact hash is required, the installation resolves to and downloads the compromised component.
  4. Malicious code executes during package installation, browser installation, or subsequent invocation of Playwright by the extraction script.
  5. The payload operates with the privileges and environment access of the account running the installation or extraction command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. T ...[truncated 365 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a specifically reviewed version, for example through an exact requirement such as playwright==<reviewed-version>.
  2. Commit a dependency lockfile containing cryptographic hashes and install with hash enforcement.
  3. Pin and document the corresponding Playwright-managed Chromium revision rather than implicitly accepting a future browser release.
  4. Restrict installation to the official, expected package index and document the trusted browser download source.
  5. Verify downloaded artifacts using publisher-provided checksums or signatures where available.
  6. Perform installation and browser execution in a dedicated virtual environment or isolated container under a non-privileged account.
  7. Add automated dependency scanning and a controlled review process before updating either Playwright or Chromium.
  8. Update the duplicate commands in README.md, lines 25–29, to use the same secured installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md
---
name: deepseek-extract
description: >
  Extract full conversation content from DeepSeek shared chat links.
  Use when: user provides a DeepSeek share URL (chat.deepseek.com/share/...),
  wants to extract or export a DeepSeek conversation, says "deepseek link",
  "deepseek share", "extract deepseek", "导出deepseek对话", or mentions

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: deepseek-extract
description: >
  Extract full conversation content from DeepSeek shared chat links.
  Use when: user provides a DeepSeek share URL (chat.deepseek.com/share/...),
  wants to extract or export a DeepSeek conversation, says "deepseek link",
  "deepseek share", "extract deepseek", "导出deepseek对话", or mentions

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
---
name: deepseek-extract
description: >
  Extract full conversation content from DeepSeek shared chat links.
  Use when: user provides a DeepSeek share URL (chat.deepseek.com/share/...),
  wants to extract or export a DeepSeek conversation, says "deepseek link",
  "deepseek share", "extract deepseek", "导出deepseek对话", or mentions

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/extract_deepseek.py (reported line 40)May include surrounding context.

python
def extract_conversation(url: str, headed: bool = False, timeout: int = 30000) -> dict:
    """
    Extract conversation from a DeepSeek share URL.

    Returns a dict with keys: url, title, messages
    """

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/extract_deepseek.py (reported line 346)May include surrounding context.

python
def extract_conversation(url: str, headed: bool = False, timeout: int = 30000) -> dict:
    """
    Extract conversation from a DeepSeek share URL.

    Returns a dict with keys: url, title, messages
    """

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/extract_deepseek.py (reported line 108)May include surrounding context.

python
def _extract_title(page) -> str:
    """Extract the conversation title from the page."""
    # Try multiple selectors for the title
    title_selectors = [
        "h1",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The usage examples show extracting full conversation content and writing it to markdown or JSON files, but the description does not warn users that shared chat contents may contain sensitive personal or confidential information. For a skill that copies conversation data to disk, a brief privacy and data-handling warning is expected in markdown documentation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to execute a Python script and write extracted conversation data to disk, but it declares no explicit tool scope or permissions limiting file-write behavior. This increases the chance of over-broad execution in environments that rely on manifest-level constraints, especially since the skill handles potentially sensitive exported chat content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed to extract and save full conversation contents from a shared chat link, which may contain personal, confidential, or regulated data, yet it does not require an explicit privacy warning or user confirmation before storing or presenting that content. Because the workflow also preserves the output file by default, it can create unnecessary retention of sensitive data on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script writes extracted conversation contents directly to a user-specified file without any privacy notice, confirmation step, or safeguards around sensitive data handling. Because the tool’s explicit purpose is to extract full chat transcripts, it may persist private or regulated information to disk unexpectedly, increasing the chance of local data exposure, accidental sharing, backup retention, or insecure downstream processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The formatter hard-codes Chinese headings and role labels such as '对话记录', '来源', '用户', and '未知'. This imposes a specific language/locale in generated output without any user opt-in or configuration option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.