deepseek-balance
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
python scripts/check_balance.pyto perform the balance check. Additionally, on Windows systems, the script invokeschcp 65001viasubprocess.runto ensure the terminal uses UTF-8 encoding. - [EXTERNAL_DOWNLOADS]: The Python script makes a network request to the well-known service endpoint
https://api.deepseek.com/user/balance. This is the legitimate destination for the skill's intended purpose. - [PROMPT_INJECTION]: The skill processes data from an external API, presenting an indirect prompt injection surface.
- Ingestion points:
scripts/check_balance.pyreads JSON response data from the DeepSeek API. - Boundary markers: No explicit delimiters are used in the script's stdout to separate the API response from other context.
- Capability inventory: The skill possesses network access and file system read capabilities for configuration files (
.env). - Sanitization: The script outputs the raw body of the API response to the agent without additional filtering or escaping.
Audit Metadata