research-challenge
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones the
allenai/asta-research-challengerepository from GitHub to prepare the submission. This targets the vendor's official infrastructure and is necessary for the skill's stated purpose. - [COMMAND_EXECUTION]: Executes several internal bash scripts to collect artifacts and transcripts. These scripts utilize standard utilities like
git,gh,jq, andfindto filter files based on size and.gitignorerules, ensuring only relevant project data is processed. - [DATA_EXFILTRATION]: Facilitates the transfer of project reports and agent conversation transcripts (from
~/.claude/projects/and~/.codex/sessions/) to a public GitHub repository. The workflow enforces human-in-the-loop verification by requiring the user to review the staged files and manually confirm the PR creation. - [PROMPT_INJECTION]: The skill reads local project files and its own generated markdown reports to populate the submission. While this presents an indirect prompt injection surface, the risk is mitigated by the skill's specific focus on packaging existing data and the requirement for user review of all generated content.
Audit Metadata