deep-research

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management by reading the required API_KEY from the environment. It explicitly instructs the agent never to print or log the key and avoids sourcing shell startup files, reducing the risk of accidental exposure.
  • [COMMAND_EXECUTION]: Uses standard system utilities including curl for network communication, jq for JSON processing, and uuidgen for idempotency. These commands are used as intended for the skill's research functionality.
  • [DATA_EXFILTRATION]: Sends user-provided research queries to an external service (deepapi.co). This is the primary function of the skill. It uses jq --rawfile to safely incorporate the research prompt into the JSON request body, which prevents malformed data or simple command injection within the JSON structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 09:52 AM