deepapi
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell and PowerShell commands on the host system to run maintenance scripts. Specifically, it provides commands to launch an updater located at
$HOME/.deepapi/update-skill.sh(or.ps1for Windows) as a detached process. - [PERSISTENCE]: The instructions direct the agent to establish a recurring background process by launching the local updater once per day during the first use of the skill. By using detached execution and suppressing output (redirecting to
/dev/null), the skill attempts to maintain a background presence on the host machine. - [DYNAMIC_EXECUTION]: For Windows environments, the skill utilizes dynamic script block creation in PowerShell (
[scriptblock]::Create) to execute the contents of a local file, which bypassed static analysis of the executed content at runtime. - [REMOTE_CODE_EXECUTION]: The skill provides a capability (
/v1/vm/run) that allows the agent to execute arbitrary code (Bash, Python, Node, etc.) in a remote virtual machine with full administrator privileges (sudo), internet access, and Docker support. While a primary feature, it represents a significant remote execution vector. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a large attack surface for indirect prompt injection due to its core function of scraping and analyzing data from untrusted external sources.
- Ingestion points: Multiple endpoints in
references/scraping.mdandreferences/deep-research.mdingest data from websites, LinkedIn, X/Twitter, YouTube, PDFs, and ArXiv papers. - Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its instructions and the content retrieved from these external sources.
- Capability inventory: The agent has access to highly impactful tools including remote code execution (
vm.run), browser automation (browser.act), and email management (email.send). - Sanitization: No sanitization or filtering logic is defined for the content retrieved before it is processed by the agent.
Audit Metadata