create-research
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and synthesize arbitrary content from the codebase.
- Ingestion points: The skill reads external research question files and arbitrary source code files from the codebase (SKILL.md, Steps 1 and 3).
- Boundary markers: Although the skill enforces a documentation-only persona and uses specific templates, it lacks instructions for using unique structural delimiters or 'ignore' instructions when processing external code content to prevent malicious instructions embedded in the code from influencing sub-agent behavior.
- Capability inventory: The agent has the ability to spawn multiple sub-agents (e.g., codebase-analyzer), write files to the local task directory, and execute CLI commands such as gh and ls.
- Sanitization: There are no specified sanitization or filtering steps for the content read from files before it is processed by sub-agents or included in the final synthesized output.
Audit Metadata