claude-to-deerflow
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes streaming responses from an external orchestration endpoint, exposing it to potential indirect instruction injection if the remote data source becomes untrusted.
- Ingestion points:
scripts/chat.shcaptures the server-sent events stream from the DeerFlow API via the/threads/<thread_id>/runs/streamendpoint. - Boundary markers: Responses extracted from the text stream are printed directly to stdout without isolation markers or instructions to disregard embedded commands.
- Capability inventory: The skill executes network requests via
curlto external or locally hosted endpoints, and includes an embedded Python script block for parsing SSE payloads. - Sanitization: Outbound parameters and questions are sanitized using Python's
json.dumpsimplementation, but incoming data payloads are parsed and returned in raw format.
Audit Metadata