deepseek-ask

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These files download and exec a shell script directly from a raw GitHub URL (an untrusted remote .sh execution), which is a high-risk pattern for distributing malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The scripts download and execute an unverified remote setup script at runtime (download-and-exec), exposing a high supply-chain/remote-code-execution risk; no explicit hidden exfiltration or backdoor code is present in the local files, but this behavior enables arbitrary remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Yes—outsider-authored free text from the user-supplied --prompt/--prompt-file is embedded into the JSON payload and sent to the LLM via "$FREVANA_BIN" call frevana_ask "$(cat "$payload_file")" (the daemon/extension then returns model output into the agent context), so the runtime LLM context can include attacker-controlled prompt text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup wrapper (scripts/setup.sh) downloads and executes remote code from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh at runtime, which directly executes external code required for the skill.