data-research
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill accesses and manages research recipes and data within the
~/.gbrain/directory. Accessing hidden directories in the user's home folder is a sensitive operation as these paths are typically used for storing application-specific configuration and private data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted sources, making it susceptible to indirect prompt injection where malicious instructions could be embedded in the processed data.
- Ingestion points: Retrieves content from external emails (via credential gateway), web search results, API responses, and file attachments (PDF/HTML) during Phase 2.
- Boundary markers: The skill follows an "EXTRACTION INTEGRITY RULE" to save raw source data and re-read it during batch processing to prevent hallucinations, but does not specify delimiters or instructions to ignore embedded commands in the source data.
- Capability inventory: The skill utilizes tools to write data to the brain (
put_page,put_raw_data), modify timelines (add_timeline_entry), and upload files (file_upload). - Sanitization: Extraction is performed using deterministic regex with an LLM fallback, but the skill lacks explicit sanitization or filtering to prevent the agent from acting on instructions hidden within the research sources.
Audit Metadata