research-visualizer

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the installation and execution of the ara Rust binary (via ara-cli on Cargo or ARA-Labs/tap/ara on Homebrew) to validate and serve research artifacts. While this involves executing external code, the instructions explicitly require user confirmation before any installation occurs.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the ara CLI utility from the vendor's GitHub repository (github.com/ARA-Labs/ara-cli) when the tool is missing from the environment.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to perform environment checks (which ara), process management (lsof, pkill), and to drive the vendor CLI (ara check, ara serve). It also uses Python to Base64-encode local image assets for inlining.
  • [DYNAMIC_EXECUTION]: The skill generates a self-contained HTML file (trajectory.html) by injecting a dynamically generated JSON payload into a predefined template. It uses specific markers (/* __ARA_DATA_BEGIN__ */) for injection and implements an 'Injection contract' to escape potential script tags.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external research data from trace/exploration_tree.yaml and various Markdown files. Because the agent is instructed to summarize the 'thinking' and 'body' fields into plain human language, malicious instructions embedded within these research artifacts could potentially influence the agent's summarization behavior.
  • Ingestion points: trace/exploration_tree.yaml, PAPER.md, logic/*.md, and evidence/*.md (referenced in references/parsing.md).
  • Boundary markers: The skill defines an injection contract for the HTML output (escaping < and </script>), but lacks explicit boundary delimiters for the internal summarization process.
  • Capability inventory: The agent possesses Write, Bash, and Read capabilities, allowing it to modify files or execute commands based on potentially manipulated instructions.
  • Sanitization: Basic escaping is performed for the final HTML injection, but not for the semantic processing of the research narrative.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 03:43 AM