deepwork
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes information from specialist agents, creating a potential surface for indirect instructions.
- Ingestion points: Context is pulled from @librarian research and @explorer scans into the deepwork state file (.slim/deepwork/ directory).
- Boundary markers: The instructions lack specific delimiters or instructions to ignore embedded commands within the findings retrieved from specialists.
- Capability inventory: The skill can write files to the local filesystem and modify repository configuration files (.gitignore, .ignore).
- Sanitization: No data sanitization or filtering is prescribed for the information gathered from specialist roles.
- [SAFE]: The skill's operations are aligned with its described purpose of project orchestration and use local storage for workflow state management without suspicious external communications.
Audit Metadata