dp-ask-deepworks
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script (
scripts/ask_local_deepworks.py) to interface with the DeepWorks desktop application.\n- [DATA_EXPOSURE]: The script reads local authentication tokens and port information fromdeepworks-port-state.jsonanddeepworks-server-tokens.jsonwithin the user's AppData directory. These secrets are used exclusively for authenticating requests to the local DeepWorks service at127.0.0.1.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles data from the local agent's responses, which represents a potential surface for indirect prompt injection.\n - Ingestion points: The
--messageparameter and the assistant's response data fetched from the local API.\n - Boundary markers: No explicit delimiters are used to wrap user input or agent responses.\n
- Capability inventory: Access to local configuration files, local network communication, and filesystem write operations for logging.\n
- Sanitization: The skill does not filter or sanitize the message content before or after processing.
Audit Metadata