langchain-deep-agents
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Deep Agent' architecture which naturally creates an indirect prompt injection surface through its shared virtual filesystem.
- Ingestion points: Untrusted data enters the agent context via the
fileskey inDeepAgentState, which stores outputs from various subagents as described inSKILL.mdandreferences/architecture-blueprint.md. - Boundary markers: The skill explicitly instructs developers to use
SystemMessage(override=True)and fresh message lists for subagent invocations to isolate personas and prevent instruction leakage, which serves as a significant boundary mechanism. - Capability inventory: The agent is configured with powerful tools including
Bash(python:*),Read,Write, andEdit, which could be targeted if malicious instructions are successfully injected into the graph state. - Sanitization: The instructions recommend structural validation of subagent outputs and the use of file summaries instead of full content in the reflection node, reducing the risk of processing malicious payloads directly.
Audit Metadata