gemini-deep-research
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data that is then processed by an LLM.
- Ingestion points: User-provided queries and format specifications enter the system via the
--queryand--formatarguments inscripts/research.py. - Boundary markers: The skill uses minimal boundary markers, primarily interpolating user input directly into a string template before sending it to the API.
- Capability inventory: The script has the capability to perform network operations (HTTPS requests via
httpx) and write to the local file system (~/.cache/deep-research). - Sanitization: The script validates interaction IDs using a regular expression but does not perform escaping or filtering on the main query content, relying on the underlying API's safety filters.
- [COMMAND_EXECUTION]: The skill's primary interface is a Python script (
scripts/research.py) designed to be executed from the command line. This script performs network communication, file system management, and result parsing. - [EXTERNAL_DOWNLOADS]: The skill communicates with Google's official Gemini API endpoint at
https://generativelanguage.googleapis.com. This is a well-known service used for the skill's primary purpose of conducting research.
Audit Metadata