deep-research
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The orchestration script scripts/run_deep_research.py utilizes subprocess.run to execute assets/deep_research.py. This is used to delegate the core API logic to a standalone component within the skill's directory structure.
- [EXTERNAL_DOWNLOADS]: The research script interacts with the OpenAI API to conduct web searches and generate reports. These network operations target a trusted, well-known service provider and are necessary for the skill's primary function.
- [DATA_EXFILTRATION]: Research outputs and enhanced prompts are saved to local timestamped files (research_report_.md, research_prompt_.txt). No data exfiltration to unauthorized external destinations was detected.
- [PROMPT_INJECTION]: The skill processes user-supplied prompts and retrieves web content via API calls, representing an indirect prompt injection surface. Ingestion points: User-provided research query and OpenAI API search results; Boundary markers: Not present in prompt construction or output files; Capability inventory: Subprocess execution and local file-writing; Sanitization: None observed for external data interpolation. This surface is characteristic of research-oriented AI tools.
Audit Metadata