skill-autoresearch
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and executing content from external target skills, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads the target SKILL.md file, linked references, and test inputs provided by the user (Step 1, Step 4).
- Boundary markers: No specific delimiters or security boundaries are defined to isolate untrusted content from the optimization logic or to warn the agent about potential instructions within data.
- Capability inventory: The skill is authorized to use Bash, Edit, Write, and WebFetch to modify files and run evaluation tests (metadata, Step 5).
- Sanitization: The instructions do not include steps to sanitize, escape, or validate the target content or test inputs before they influence the agent's mutation hypotheses or are executed via shell tools.
Audit Metadata