deepseek-worker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deepseek-worker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Send a prompt to DeepSeek via browser and return the response.
browser-start.js, browser-nav.js, browser-eval.js, browser-screenshot.jsprompt: string # The text to send to DeepSeek
task_type: string # qa | summary | translation | rewrite | extraction | comparison | brainstorming | analysisAlways output this JSON block first:
{
"site": "deepseek",
"task_type": "<task_type>",
"status": "success | partial | error",
"answer": "<extracted response text>",
"retry_count": 0,
"elapsed_ms": 0,
"error_reason": null
}Then follow with a short human-readable summary (2–3 sentences max).
node ~/.pi/agent/skills/local-browser-tools/browser-start.jsExpected: ✓ Chrome already running on :9222 or ✓ Chrome started on :9222
If fails: return error status, stop.
node ~/.pi/agent/skills/local-browser-tools/browser-nav.js https://chat.deepseek.comTake a screenshot and verify:
If login page appears: return error_reason: "login_required", stop.
DeepSeek uses a <textarea> with placeholder="Message DeepSeek". Note: no aria-label.
Check:
!!document.querySelector('textarea[placeholder="Message DeepSeek"]')Fallback selectors in order:
textarea[placeholder="Message DeepSeek"]textareaIf no selector works after 3 attempts: trigger retry.
DeepSeek uses React — setting textarea.value directly does NOT update React's internal state and will cause "Message is empty" on send. Must use nativeInputValueSetter:
``javascript (function() { const input = document.querySelector('textarea[placeholder="Message DeepSeek"]') || document.querySelector('textarea'); if (!input) return "NOT_FOUND"; input.focus(); const nativeInputValueSetter = Object.getOwnPropertyDescriptor( window.HTMLTextAreaElement.prototype, 'value' ).set; nativeInputValueSetter.call(input, ""); nativeInputValueSetter.call(input, PROMPT_TEXT); input.dispatchEvent(new Event("input", { bubbles: true })); return input.value; })() ``
Verify returned value matches the intended prompt. If mismatch: retry.
Take a screenshot to confirm text appears in the textarea.
DeepSeek's send button is a div with role="button", NOT a native button element. Ctrl+Enter adds a newline — do NOT use it.
Click the send button: ``javascript Array.from(document.querySelectorAll('[role="button"]')) .filter(b => { const cls = typeof b.className === 'string' ? b.className : ''; return cls.includes('ds-icon-button') && !cls.includes('ds-icon-button--disabled'); }) .pop() ?.click() ``
After sending, take a screenshot to confirm the message bubble appears.
Poll every 3 seconds, maximum 120 seconds total. Do NOT use fixed sleep.
Spinner selectors are unreliable. Use response length stability as the primary completion signal:
Response extraction for polling:
(function() {
const msgs = document.querySelectorAll('[class*="message"], [class*="ds-markdown"], [class*="chat"]');
if (msgs.length > 0) return msgs[msgs.length - 1].innerText?.trim()?.length || 0;
return 0;
})()If 120 seconds pass with no stable response: trigger retry.
``javascript (function() { const direct = document.querySelector('div.ds-markdown.ds-assistant-message-main-content'); if (direct) return direct.innerText?.trim(); const para = document.querySelector('p.ds-markdown-paragraph'); if (para) return para.innerText?.trim(); return "EXTRACTION_FAILED"; })() ``
Validate the result:
If validation fails: trigger retry.
https://chat.deepseek.com before retryingstatus: "error" with error_reason explaining which step failedDeepSeek uses hashed class names (e.g. _27c9245, c3ecdb44) that change between deployments. Do NOT rely on these. If selectors stop working:
browser-eval.js to find all textarea, [role="button"], and elements with visible text{
"site": "deepseek",
"task_type": "analysis",
"status": "success",
"answer": "Here is my analysis...",
"retry_count": 0,
"elapsed_ms": 35000,
"error_reason": null
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.