deepsource
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
deepsourceCLI to perform various actions such as authentication (deepsource auth login) and retrieving analysis data (deepsource issues,deepsource report-card,deepsource vulnerabilities). These are standard operations for the intended use case. - [EXTERNAL_DOWNLOADS]: The skill references the official installation documentation at
https://deepsource.com/docs/developers/cli/installation. This is a link to the vendor's own website for utility setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from DeepSource analysis reports which could theoretically contain malicious instructions if the source repository or DeepSource account is compromised.
- Ingestion points: Data enters the context through
deepsource issues,deepsource report-card,deepsource vulnerabilities, anddeepsource runscommands inSKILL.md. - Boundary markers: None present; the JSON output is parsed directly into the agent's context.
- Capability inventory: The skill primarily executes the
deepsourceCLI tool as defined inSKILL.md. - Sanitization: No explicit sanitization or filtering of the CLI's JSON output is defined in the instructions.
Audit Metadata