gracker-deep-research
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to scan and read contents from local user directories (e.g., 'Notes', 'Articles', 'KnowledgeBase') to gather context for research. While this is the primary feature, it represents a data exposure risk as sensitive local information is ingested into the AI agent context. Evidence: Phase 0 scanning logic in SKILL.md using ripgrep.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from both local files and external web pages without explicit boundary markers or sanitization. Evidence: Ingestion points in SKILL.md (Phase 0 and Phase 1c); lack of delimiters for untrusted content; the agent has capabilities for shell command execution and file system operations.
- [COMMAND_EXECUTION]: The skill provides explicit shell commands (such as 'rg', 'mkdir', and 'cat') that the agent is expected to execute in the user's local environment to manage research materials. Evidence: Phase 0, 1a, and 1d instructions in SKILL.md.
- [REMOTE_CODE_EXECUTION]: The included test suite executes the skill's internal Python scripts using shell processes. Evidence: subprocess.run calls in tests/test_publish_to_obsidian.py.
- [EXTERNAL_DOWNLOADS]: The skill performs automated fetching of external web content based on URLs discovered during the research phase. Evidence: Phase 1c archive logic in SKILL.md.
Audit Metadata