deepline-ads-audiences
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external CSV files (e.g., customer or prospect lists) as seen in
plays/build-hash-only-audience.play.tsandplays/enrich-audience-waterfall.play.ts. - Ingestion points: Data is loaded from user-provided file paths into datasets using
ctx.csvacross multiple play files. - Boundary markers: The scripts do not implement specific delimiters or 'ignore' instructions for the data being processed.
- Capability inventory: The skill has the ability to execute network-based tools (ad platform APIs and enrichment providers), create new datasets, and export files to the workspace.
- Sanitization: While the skill performs technical validation (regex for email formats and SHA-256 hex length), it does not sanitize inputs for prompt-based instructions.
- [EXTERNAL_DOWNLOADS]: The skill's setup instructions in
SKILL.mdrequire the installation of thedeeplineCLI tool, recommending a fallback installation from a custom registry athttps://code.deepline.com/api/v2/npm/for secure sandboxes. - [COMMAND_EXECUTION]: The skill operates primarily through shell commands and a dedicated CLI (
deepline), managing authentication, tool discovery, and execution via subprocesses.
Audit Metadata