research
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local command-line interface named "workflow" (e.g., "workflow knowledge ingest", "workflow knowledge lint") to manage the knowledge base. It also utilizes "rg" (ripgrep) to search for duplicate entries in the local filesystem at "~/.codex/knowledge/raw".- [EXTERNAL_DOWNLOADS]: The skill retrieves content from external URLs provided by the user via WebFetch and Chrome DevTools MCP tools. This is the primary data source for the research workflow.- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted content from external websites.
- Ingestion points: External data enters the context via WebFetch and the "take_snapshot" tool from the Chrome DevTools MCP.
- Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" guards for the fetched article content.
- Capability inventory: The skill can execute local shell commands via the Bash tool and write files to the local directory "~/.codex/knowledge".
- Sanitization: The workflow includes a linting step ("workflow knowledge lint") and a validation step ("workflow knowledge validate") to ensure the extracted insights meet the required schema and metadata standards before being ingested into the knowledge base.
Audit Metadata