scientific-agent-skills
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to discover and install content from an external repository containing over 160 sub-skills. Processing such a large volume of third-party instruction files (SKILL.md) creates an attack surface where malicious text in the remote repository could attempt to influence the agent's behavior during the audit or routing process.\n
- Ingestion points: The scripts/audit-pack.py helper reads SKILL.md and support files from a local clone of the scientific-agent-skills repository.\n
- Boundary markers: The skill provides strong boundary instructions in its references, stating that remote text never becomes agent policy and requiring separate approval gates for operation.\n
- Capability inventory: The skill possesses Bash and file writing capabilities (via npx skills add) to install audited instructions.\n
- Sanitization: While the audit-pack.py script identifies risk patterns using regex, the agent still processes the raw text of the instructions.\n- [COMMAND_EXECUTION]: The included utility script scripts/audit-pack.py uses the subprocess module to execute git commands. This is used to verify the provenance of the repository, including the origin URL and the specific commit hash.\n
- Evidence: The git_read function in scripts/audit-pack.py calls subprocess.run to extract metadata.\n- [EXTERNAL_DOWNLOADS]: The skill instructions involve cloning a remote repository from GitHub to stage skills for installation.\n
- Evidence: Instructions in SKILL.md and its references direct the agent to clone the K-Dense-AI scientific-agent-skills repository.\n
- Context: The repository is the legitimate source for the scientific skills being managed, and GitHub is a well-known service.
Audit Metadata