research
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs discovery and execution of local shell scripts. It scans the user's home directory (e.g., $HOME/.agents/skills/) to locate sibling tools like exa, tinyfish, and firecrawl, which are then invoked via bash to perform sub-tasks.
- [EXTERNAL_DOWNLOADS]: The alphaxiv.sh script fetches structured paper summaries and full-text metadata from the external domain alphaxiv.org using curl.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests content from external, untrusted sources including web search highlights, scraped HTML content, and academic paper summaries. These inputs are synthesized into a final report without explicit boundary markers or sanitization, potentially allowing malicious instructions embedded in the researched content to influence the agent's behavior during the synthesis phase.
- Ingestion points: Web search results from Exa, full-page content from TinyFish and Firecrawl, and AI-generated paper summaries from AlphaXiv.
- Boundary markers: Absent; the synthesizer merges findings without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill possesses the ability to execute shell scripts and write to the local filesystem (e.g., /tmp/research- artifacts).
- Sanitization: No validation or filtering is applied to the fetched text before interpolation into the synthesis prompt.
Audit Metadata