ulw-research
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly supersede and override surrounding safety filters, exploration-bounding constraints, and retrieval budgets during its research phases.
- [COMMAND_EXECUTION]: The skill performs numerous subprocess calls to external binaries, including 'node' for internal tooling, 'chrome' for headless rendering, 'pandoc' for document conversion, and the 'latexmk' suite for PDF generation.
- [DYNAMIC_EXECUTION]: Phase 4 of the research protocol requires the agent to generate and execute its own code snippets via 'uv run' to verify claims discovered during research, which constitutes dynamic execution of agent-generated logic.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process massive quantities of untrusted data from the web and external repositories. 1. Ingestion points: Data enters via member task replies, browsing results, and repository dives (Phase 2). 2. Boundary markers: The skill does not define clear delimiters or 'ignore' instructions for processing this content. 3. Capability inventory: The agent has the ability to write files, execute system commands, and run generated code. 4. Sanitization: There are no instructions for sanitizing or escaping the retrieved external content before it is synthesized into reports or used to generate verification scripts.
Audit Metadata