deepagents-setup-configuration
Warn
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The 'calculate' tool provided in the 'basic-deep-agent' example (assets/examples/basic-deep-agent/agent.py) and generated by the project initialization script (scripts/init_deep_agent_project.py) uses the 'eval()' function to process mathematical expressions. While the Python example implements a character whitelist and restricts built-in functions, 'eval' remains a highly risky pattern for processing strings influenced by LLM output. The JavaScript template generated by the script uses 'eval()' without any sanitization, which could lead to arbitrary code execution if the agent is tricked into evaluating a non-mathematical payload.
- [INDIRECT_PROMPT_INJECTION]: The skill enables the creation of agents with powerful integrated tools, including filesystem access (read/write/edit) and dynamic code execution (via the 'calculate' tool). This configuration presents a surface for indirect prompt injection attacks where malicious instructions hidden in ingested files could target the agent's capabilities to execute unauthorized code or modify files without proper oversight.
- Ingestion points: 'read_file' tool (built-in middleware) and user queries.
- Boundary markers: The provided templates do not implement explicit delimiters or 'ignore embedded instructions' warnings for file content processing.
- Capability inventory: 'write_file', 'edit_file', 'task' (subagent delegation), and 'calculate' (dynamic execution).
- Sanitization: A basic character whitelist is present in the Python example, but the generated JavaScript template lacks input validation.
- [SAFE]: The skill implements secure secret management patterns by using '.env.example' files with placeholders and configuring '.gitignore' to exclude active environment files. It also correctly references official LangChain documentation for guidance.
Audit Metadata