alterlab-hypogenic
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from JSON datasets and PDF research papers, which constitutes an indirect prompt injection surface.
- Ingestion points: Training, validation, and test datasets in JSON format (referenced in
config.yaml), along with PDF files located in theliterature/directory. - Boundary markers: The skill uses structured YAML templates in
references/config_template.yamlwith definedsystemanduserroles and${placeholder}variable substitution. No explicit instructions are present to disregard potential instructions embedded in the data. - Capability inventory: Access to
Bash(uv, python, git, and package-specific CLI tools),Read,Write, andEditfile operations, and network access for LLM API calls and GitHub cloning. - Sanitization: The implementation uses regex-based extraction (
extract_label) to parse LLM outputs; however, there is no evidence of sanitization or filtering applied to the input data before it is interpolated into prompts. - [EXTERNAL_DOWNLOADS]: The skill downloads resources from external repositories to function.
- Fetches example datasets from the
ChicagoHAIorganization on GitHub (https://github.com/ChicagoHAI/HypoGeniC-datasets.gitandhttps://github.com/ChicagoHAI/Hypothesis-agent-datasets.git). - Installs the
hypogenicpackage from the official Python Package Index (PyPI) usinguv. - [COMMAND_EXECUTION]: The skill performs several command-line operations to set up and run the hypothesis generation pipeline.
- Utilizes
uv pip installfor dependency management. - Uses
git cloneto retrieve datasets from GitHub. - Executes local shell scripts (
setup_grobid.sh,run_grobid.sh) to initialize the GROBID service for PDF processing. - Runs Python scripts and package-specific CLI entry points (
hypogenic_generation,hypogenic_inference) to perform its primary hypothesis testing and generation functions.
Audit Metadata