Skills
skills/yaojingang/yao-geo-skills/yao-deepseek-crawler/Gen Agent Trust Hub

yao-deepseek-crawler

Warn

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/setup_deepseek_bridge.mjs downloads a browser extension archive from the GitHub releases of the jackwener/opencli repository. This repository is not associated with a trusted organization or well-known service. The script subsequently unzips and loads this extension into the browser to enable the core crawling functionality.
  • [COMMAND_EXECUTION]: Node.js implementation scripts use spawn and execFileSync to execute system utilities and local scripts. scripts/setup_deepseek_bridge.mjs runs pkill to manage existing browser processes and unzip for archive extraction. scripts/deepseek_batch_crawl.mjs spawns a crawler script from a path that can be dynamically controlled via command-line arguments or environment variables.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface (Category 8) by ingesting untrusted results from DeepSeek AI search queries. Maliciously crafted responses from the search engine could attempt to manipulate the analysis logic or influence subsequent actions of the agent processing the output.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 30, 2026, 01:56 PM
Security Audit — agent-trust-hub — yao-deepseek-crawler