research-compendium
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves fetching and archiving content from untrusted external sources (web articles, research papers, etc.). This content may contain malicious instructions designed to manipulate the agent. The skill acknowledges this risk and provides defensive instructions to mitigate it, but the surface remains inherent to the tool's purpose.\n
- Ingestion points: External data enters the system through web search and fetch operations described in Phase 1 and Phase 2 of
SKILL.md.\n - Boundary markers: The instructions specify using
untrusted_directives: truein the frontmatter and wrapping imperative text inuntrusted-quotedfenced blocks to prevent execution.\n - Capability inventory: The skill uses tools to write files (
gbrain upload-raw,gbrain write-request), delegates tasks (minion-orchestrator), and can publish content to shareable pages (gbrain publish).\n - Sanitization: The skill commands the agent to treat fetched text as data only, never to obey directives found within it, and to neutralize them at the boundary.
Audit Metadata