route-researcher
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill invokes
uvxinSKILL.mdandtools/fetch_conditions.pyto download and execute thepeakbagger-clitool directly from the author's GitHub repository (github.com/dreamiurg/peakbagger-cli.git@v1.7.0). - [COMMAND_EXECUTION]:
- The
fetch_conditions.pyscript usessubprocess.runto execute shell commands for interacting with the PeakBagger CLI tool. SKILL.mdorchestrates various shell tasks, including running Python tools and dispatching specialized researcher agents that utilize theuv run pythonpattern.- The
Report Revieweragent has access to theEdittool to modify generated report files. - [EXTERNAL_DOWNLOADS]:
- The skill fetches real-time mountain data, weather forecasts, and avalanche information from several external sources including Open-Meteo, Mountain-Forecast.com, and the Northwest Avalanche Center (NWAC).
- The
tools/cloudscrape.pyscript uses thecloudscraperlibrary to fetch HTML content from mountaineering websites (such as SummitPost and PeakBagger) to bypass bot protections. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes untrusted trip report content from various community-driven mountaineering websites.
- Ingestion points: Researcher agents in
SKILL.md(Phase 3B) ingest data frompeakbagger.com,summitpost.org,wta.org, andalltrails.com. - Boundary markers: The agent prompts lack explicit instructions to ignore or delimit embedded commands within the fetched trip report text.
- Capability inventory: The skill has the capability to write files (via the Report Writer agent) and execute shell commands (via Python tools).
- Sanitization: Fetched web content is processed by LLM agents with minimal sanitization, relying on the agents to extract relevant information according to a JSON schema.
Audit Metadata