deepline-scoring

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed for ICP signal discovery and account rescoring. It uses deterministic Python scripts to perform lexical analysis on provided datasets.
  • [COMMAND_EXECUTION]: The Quick Start section in SKILL.md suggests installing the deepline CLI tool via npm install -g deepline. This is a vendor-provided tool consistent with the skill's purpose and name.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (website content and job descriptions) from CSV inputs.
  • Ingestion points: Data enters through the website and jobs columns of input CSV files processed by scripts/analyze_signals_v2.py.
  • Boundary markers: The skill does not interpolate raw external data into LLM prompts; instead, it performs local lexical matching and statistical analysis.
  • Capability inventory: Scripts are limited to file system I/O for reading CSVs and writing JSON results. The replay-score.play.ts script interacts with the deepline dataset API.
  • Sanitization: scripts/analyze_signals_v2.py applies NFKC normalization to all input text and uses boundary-aware regex matching to avoid misinterpretation of content.
  • [DATA_EXFILTRATION]: No unauthorized network operations or exfiltration patterns were detected. The skill instructions explicitly advise keeping customer data, rules, and receipts within the local project directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 12:22 PM