research
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the internet, which could contain malicious instructions meant to manipulate the agent.
- Ingestion points: In Step 2 (Fan out), the subagent brief instructs the agent to 'Search the web' and specifically use sources like App Store reviews, Reddit, Hacker News, and forums, which are attacker-controllable.
- Boundary markers: The skill uses structural markdown templates and a tagging system ([V] verified, [K] knowledge, [U] unverified) to organize findings, but it lacks explicit 'ignore embedded instructions' warnings for the external content being processed.
- Capability inventory: The skill has the capability to write files to the local file system (Step 3:
docs/research/<topic>.md) and call other skills (Step 4:cloneandapp-brief). A poisoned research result could lead the agent to write malicious summaries or call theclonetool on a malicious repository. - Sanitization: There is no mention of sanitizing or escaping the content retrieved from the web before it is interpolated into the research documents or used to drive subsequent tool calls.
Audit Metadata