tw-research-quality-gate
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing user-provided text, such as full papers, specific chapters, or paragraphs (SKILL.md, Step 1 and 2), which creates a vulnerability to indirect prompt injection.
- Ingestion points: The agent is prompted to read and evaluate external content provided by the user under "評估對象" (Evaluation Object).
- Boundary markers: The instructions fail to define explicit delimiters or enclose the untrusted input in markers that would help the model distinguish between data to be analyzed and instructions to be followed.
- Capability inventory: The skill's environment is configured with access to
Bash,Read, andWritetools (frontmatter), which increases the potential impact of a successful injection attack. - Sanitization: No sanitization, escaping, or explicit "ignore embedded instructions" directives are present to mitigate the risk of the agent obeying commands contained within the academic text.
Audit Metadata