research-question
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions define a command-line pattern
<lit> search "<q>"where research questions (derived from user input or generated) are interpolated directly into shell commands. This creates a risk of command injection if the input contains shell metacharacters or quotes.\n- [REMOTE_CODE_EXECUTION]: The skill relies on an external Python script (lit_search.py) located in a configurable path (~/.claude/skills/literature-search/). The skill executes this script usingpython3, which represents the execution of code outside the skill's own package. While described as a 'sibling skill', this dependency is not verified and is controlled by a local configuration file (loop.run.yaml).\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting untrusted data fromWebSearch,WebFetch, and the output of the literature search tool. This content is passed to a 'Grader' subagent to influence the scoring and refinement of questions.\n - Ingestion points:
SKILL.md - 'Gather novelty evidence' step (WebSearch, WebFetch, LitSearch output).\n
- Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore embedded instructions in the search results.\n
- Capability inventory: Subprocess execution of Python scripts, file writes to the sandbox and config files, and network operations via web search tools.\n
- Sanitization: Absent. No explicit validation or escaping of external content before processing by the subagent is mentioned.
Audit Metadata