research-visualizer
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of the
araRust binary (viaara-clion Cargo orARA-Labs/tap/araon Homebrew) to validate and serve research artifacts. While this involves executing external code, the instructions explicitly require user confirmation before any installation occurs. - [EXTERNAL_DOWNLOADS]: The skill downloads the
araCLI utility from the vendor's GitHub repository (github.com/ARA-Labs/ara-cli) when the tool is missing from the environment. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform environment checks (which ara), process management (lsof,pkill), and to drive the vendor CLI (ara check,ara serve). It also uses Python to Base64-encode local image assets for inlining. - [DYNAMIC_EXECUTION]: The skill generates a self-contained HTML file (
trajectory.html) by injecting a dynamically generated JSON payload into a predefined template. It uses specific markers (/* __ARA_DATA_BEGIN__ */) for injection and implements an 'Injection contract' to escape potential script tags. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external research data from
trace/exploration_tree.yamland various Markdown files. Because the agent is instructed to summarize the 'thinking' and 'body' fields into plain human language, malicious instructions embedded within these research artifacts could potentially influence the agent's summarization behavior. - Ingestion points:
trace/exploration_tree.yaml,PAPER.md,logic/*.md, andevidence/*.md(referenced inreferences/parsing.md). - Boundary markers: The skill defines an injection contract for the HTML output (escaping
<and</script>), but lacks explicit boundary delimiters for the internal summarization process. - Capability inventory: The agent possesses
Write,Bash, andReadcapabilities, allowing it to modify files or execute commands based on potentially manipulated instructions. - Sanitization: Basic escaping is performed for the final HTML injection, but not for the semantic processing of the research narrative.
Audit Metadata