idea-mining
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a significant attack surface for indirect prompt injection by directing the agent to search and ingest content from untrusted external domains.
- Ingestion points: Phase A (Technique 6) explicitly instructs the agent to search the web, domain databases, preprint servers, and forums (Reddit, ResearchGate, GitHub) for new publications and scripts. The results are loaded into a
_sources/folder and read for innovations. - Boundary markers: The instructions lack requirements for using boundary markers, delimiters, or specific "ignore embedded instructions" warnings when processing the retrieved external content.
- Capability inventory: The skill possesses broad file-system capabilities, including writing to
IDEENSPEICHER.md, project documentation (proof notes, decision logs), and performing "outbound transfers" by adding TODO entries to up to three "sibling projects" (lateral movement across the project inventory). - Sanitization: There are no instructions to sanitize or validate the external content before it is interpolated into the workflow or written to local/sibling files.
- [EXTERNAL_DOWNLOADS]: The skill workflow involves downloading external research papers, scripts, and approaches from unverified sources into a
_sources/directory. While this serves the primary purpose of the skill (innovation and research), it facilitates the entry of unverified and potentially malicious content into the agent's execution environment.
Audit Metadata