until-done
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an autonomous loop (Plan-Act-Observe-Verify) that processes a user-supplied 'goal'. The absence of boundary markers or sanitization for this goal, as well as for 'external research' data ingested into the vault, creates a surface for malicious instructions to manipulate the agent.
- Ingestion points: User goal argument (SKILL.md); external data sources via 'research-from-vault'.
- Boundary markers: Absent; the agent is not instructed to isolate or ignore instructions embedded within the processed data.
- Capability inventory: The loop involves 'Act' and 'Verify' steps which can include file system writes and command execution.
- Sanitization: No sanitization is performed on the input goal or the external research content.
- [DYNAMIC_EXECUTION]: The skill explicitly permits users to provide 'verifier override' commands directly in the prompt. These user-supplied strings are executed by the agent during the loop's 'Verify' phase, enabling arbitrary command execution.
- [REMOTE_CODE_EXECUTION]: The skill facilitates fetching external research to populate a local vault. This mechanism downloads untrusted remote data which can subsequently influence the agent's autonomous execution if it contains embedded instructions.
Audit Metadata