oma-deepsec
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
deepsecCLI and related dependencies using standard package managers (bun, pnpm, npm) from Vercel's official repositories and public registries. - [COMMAND_EXECUTION]: The skill executes a variety of
deepsecCLI commands to perform its core functions, including initializing workspaces, running vulnerability scans, and exporting reports. - [DATA_EXFILTRATION]: As an agent-powered scanner, the tool transmits repository code snippets to trusted AI providers, such as Vercel AI Gateway, Anthropic, and OpenAI, for security analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of processing untrusted code in repositories or pull requests. It provides specific architectural mitigations, such as a two-job CI workflow to isolate repository-write permissions and a sandbox mode to restrict network egress and protect API keys.
Audit Metadata