deepline-scoring
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for ICP signal discovery and account rescoring. It uses deterministic Python scripts to perform lexical analysis on provided datasets.
- [COMMAND_EXECUTION]: The Quick Start section in
SKILL.mdsuggests installing thedeeplineCLI tool vianpm install -g deepline. This is a vendor-provided tool consistent with the skill's purpose and name. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (website content and job descriptions) from CSV inputs.
- Ingestion points: Data enters through the
websiteandjobscolumns of input CSV files processed byscripts/analyze_signals_v2.py. - Boundary markers: The skill does not interpolate raw external data into LLM prompts; instead, it performs local lexical matching and statistical analysis.
- Capability inventory: Scripts are limited to file system I/O for reading CSVs and writing JSON results. The
replay-score.play.tsscript interacts with thedeeplinedataset API. - Sanitization:
scripts/analyze_signals_v2.pyappliesNFKCnormalization to all input text and uses boundary-aware regex matching to avoid misinterpretation of content. - [DATA_EXFILTRATION]: No unauthorized network operations or exfiltration patterns were detected. The skill instructions explicitly advise keeping customer data, rules, and receipts within the local project directory.
Audit Metadata