The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to install and run an MCP server directly from an external GitHub repository (github:louchi1984-coder/deepseek-claude-code-worker-mcp) using npx. This method downloads and executes code from a third-party source that is not verified as belonging to the skill author.
[REMOTE_CODE_EXECUTION]: The recommended installation method (npx github:louchi1984-coder/...) results in immediate execution of remote code. Additionally, the skill's primary function is to trigger background coding jobs that execute implementation tasks via the Claude Code CLI and DeepSeek API.
[COMMAND_EXECUTION]: The deepseek_start_implementation tool supports a validation_commands argument, which allows the execution of arbitrary shell commands (e.g., npm test, npm run lint) within the project's working directory. While it mentions safety hooks to block dangerous commands, the underlying capability for arbitrary execution remains present.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the user's codebase.
Ingestion points: The worker reads project files in the cwd and interprets the user-provided task description.
Boundary markers: The skill uses allowed_dirs and forbidden_paths to define scope, but these do not prevent the LLM from obeying instructions embedded within the codebase content it is authorized to read.
Capability inventory: The skill possesses significant capabilities, including file system read/write and shell command execution (bash, npm, etc.).
Sanitization: Although the skill describes a PreToolUse hook to filter dangerous commands, static analysis cannot verify the robustness of this sanitization against sophisticated injections.
[CREDENTIALS_UNSAFE]: The skill requires high-privilege credentials, including DEEPSEEK_API_KEY and ANTHROPIC_AUTH_TOKEN. While it encourages standard practices like using environment variables or secret files, these tokens are accessible to the unverified MCP server code executed during installation and runtime.

deepseek-claude-code-worker-mcp