research-companion
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the ingestion of untrusted external content. It reads research data from wiki files (wiki/*.md) and state files (.claude/research-state.yaml) to guide agent behavior without employing boundary markers or sanitization.
- Ingestion points: SKILL.md ($ARGUMENTS), .claude/research-state.yaml, and various wiki markdown files.
- Boundary markers: Absent. The skill does not use delimiters or instructions to the agent to ignore potentially malicious instructions embedded in the ingested research data.
- Capability inventory: The skill utilizes the Agent tool for sub-agent orchestration, Read/Write for file system operations, and WebSearch/WebFetch for network access.
- Sanitization: Absent. There is no evidence of filtering or validation for content retrieved from the file system or user input before processing.
- [COMMAND_EXECUTION]: The skill refers to and relies on external shell scripts, specifically 'setup.sh' and 'research_hook.sh'. While the skill's allowed-tools list does not include a direct shell tool, the instructions assume these scripts will be executed by the environment or the user during setup and project events.
- [DATA_EXFILTRATION]: The skill accesses sensitive project-specific metadata and memory paths (e.g., ~/.claude/projects/*/memory/research-evaluations/) and possesses network access tools (WebSearch, WebFetch). This configuration presents a potential risk where project-specific data could be accessed and transmitted externally if triggered by malicious input.
Audit Metadata