deep-research
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external, untrusted sources including web search results, academic papers (via Semantic Scholar and PubMed), and arXiv documents.
- Ingestion points: Data enters the agent's context through the output of
paper-searchandpapercommands inSKILL.md(Steps 1 through 4). - Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between its instructions and content retrieved from the web.
- Capability inventory: The skill is granted powerful tools including
Bash,Write,Read,Grep, andGlob, which allow for filesystem modification and shell command execution. - Sanitization: The instructions do not specify any validation or sanitization of the external content before it is processed or synthesized into a report.
- [COMMAND_EXECUTION]: The skill instructions directly interpolate user-provided input (
$ARGUMENTS) into shell commands, such aspaper-search google web "$ARGUMENTS". This creates a potential surface for command injection if the agent environment does not strictly sanitize the input for shell metacharacters.
Audit Metadata