deepsource

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the deepsource CLI to perform various actions such as authentication (deepsource auth login) and retrieving analysis data (deepsource issues, deepsource report-card, deepsource vulnerabilities). These are standard operations for the intended use case.
  • [EXTERNAL_DOWNLOADS]: The skill references the official installation documentation at https://deepsource.com/docs/developers/cli/installation. This is a link to the vendor's own website for utility setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from DeepSource analysis reports which could theoretically contain malicious instructions if the source repository or DeepSource account is compromised.
  • Ingestion points: Data enters the context through deepsource issues, deepsource report-card, deepsource vulnerabilities, and deepsource runs commands in SKILL.md.
  • Boundary markers: None present; the JSON output is parsed directly into the agent's context.
  • Capability inventory: The skill primarily executes the deepsource CLI tool as defined in SKILL.md.
  • Sanitization: No explicit sanitization or filtering of the CLI's JSON output is defined in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 12:18 PM