deepchat-data-import
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides detailed instructions for locating and accessing sensitive application data on the local filesystem, including credentials and private message history.
- It identifies specific sensitive file paths such as
~/Library/Application Support/DeepChat/app_db/agent.dband describes the structure ofdatabase-security.jsonused for encryption management. - It provides code snippets for programmatic decryption of application data using Electron's
safeStorage.decryptStringAPI. - It explicitly targets sensitive fields like
providers.api_key, OAuth tokens, and MCP environment variables for extraction. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external data from SQLite databases, which presents an attack surface for instructions embedded in the imported content.
- Ingestion points: Data is read from
agent.dband legacychat.dbfiles, which contain user-generated and potentially external content (SKILL.md, references/data-locations.md). - Boundary markers: The instructions lack specific delimiters or "ignore previous instruction" wrappers for the data being imported, though they do recommend redacting secrets (SKILL.md).
- Capability inventory: The skill facilitates read access to the local filesystem and database operations on specific application data directories (references/sqlite-access.md).
- Sanitization: There are no documented methods for sanitizing or escaping natural language content found within the database tables before it is processed by the agent (references/import-recipes.md).
Audit Metadata