research-proposal
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks because it processes untrusted user-supplied content (research proposals) through a series of autonomous sub-agent roles. This creates a surface where embedded malicious instructions could influence agent behavior.
- Ingestion points: The proposal text is ingested from a user-defined path (
<proposal_path>) or direct prose input as described inSKILL.md. - Boundary markers: The instruction sets for the sub-agents (
roles/ScholarEval.md,roles/Judge.md,roles/Reviser.md) do not employ explicit delimiters or specialized formatting to isolate the processed proposal content from the agent's core instructions. - Capability inventory: The skill is capable of executing local Python scripts (the
literature-searchtool) which interact with academic databases, and it maintains a sandbox environment with read/write access to track iterations. - Sanitization: No validation or sanitization of the input proposal text is performed to mitigate the risk of embedded instructions affecting the LLM's logic.
Audit Metadata