researcher-role-skill
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest untrusted data from multiple sources, creating a surface for indirect prompt injection attacks.
- Ingestion points:
SKILL.mdStep 1.1 (Load context files: DEVELOPMENT_PLAN.md, ARCHITECTURE.md, TODO.md) and Step 1.3 (external sources including Official Documentation, GitHub, Stack Overflow, Reddit, HackerNews, etc.). - Boundary markers: The instructions in
SKILL.mddo not specify the use of delimiters or 'ignore embedded instructions' warnings when processing external data. - Capability inventory: The skill performs file-write operations across several steps in
SKILL.md(e.g., creatingRESEARCH_BRIEF.mdin Step 1.2,RESEARCH_REPORT_*.mdin Step 1.6, andFEATURE_RESEARCH.mdin Step 2.5) to document findings based on the ingested data. - Sanitization: The skill lacks instructions for escaping, validating, or filtering the external content before it is interpolated into the generated research documents.
- [METADATA_POISONING]: The author field 'claude-command-and-control' uses terminology typically associated with malware infrastructure (C2), which is potentially deceptive or inconsistent with the skill's professional research purpose.
Audit Metadata