deep-research
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates high security awareness. It includes explicit sanitization of hostnames and titles fetched from the web using a comprehensive regex (LABEL_STRIP) to remove control characters, zero-width spaces, and homoglyph-like quotation marks that could be used for terminal injection or UI spoofing in the agent's output.
- [INDIRECT_PROMPT_INJECTION]: While the skill fetches data from external websites (an inherent research surface), it mitigates potential injection attacks through architectural design. It implements an adversarial verification phase where claims are independently checked by multiple agents instructed to be skeptical, significantly reducing the risk of a single malicious source influencing the final report.
- [OBFUSCATION]: A static detector flagged potential homoglyphs in
scripts/workflow-script.js. Analysis confirms these characters are part of a defensive sanitization regex and explanatory comments regarding IDN homograph attacks, rather than being used for malicious intent. The code is actively filtering these characters to protect the execution environment and user. - [COMMAND_EXECUTION]: No suspicious command execution or shell injection patterns were found. The workflow uses platform-provided high-level primitives (agent, pipeline, parallel) to orchestrate tasks.
Audit Metadata