run-deep-swe
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs software from third-party sources not included in the trusted vendor lists. It clones the repository 'https://github.com/datacurve-ai/deep-swe' and installs the 'datacurve-pier' package via 'uv tool install'.
- [COMMAND_EXECUTION]: The skill provides instructions to execute several shell commands, including environment checks ('docker info', 'which uv'), repository management ('git clone'), and the primary benchmark execution tool ('pier run').
- [COMMAND_EXECUTION]: The skill instructs the agent to check and source the user's shell profile ('~/.zshrc') to verify or load the 'OPENROUTER_API_KEY'. Accessing shell configuration files is a sensitive operation as these files often contain secrets or credentials.
- [COMMAND_EXECUTION]: There is a potential for command injection if unvalidated input (such as a malicious task ID or model slug) is interpolated into the shell commands executed by the 'pier' tool.
Audit Metadata