ai-research-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including research papers (PDF/LaTeX), supplementary materials, and code repository contents (READMEs, metadata).
- Ingestion points: The skill fetches data from arXiv, GitHub, project pages, and official publication venues.
- Boundary markers: The skill employs structured templates and a 'Mechanism Review Gate' to categorize information into 'Author Claims,' 'Experimental Support,' and 'Inferences,' which helps mitigate blind obedience to instructions embedded in external documents.
- Capability inventory: The skill can write to durable documents (Notion, Feishu, Obsidian), download files, and clone Git repositories.
- Sanitization: The workflow relies on logical separation of sources and human-led reasoning gates rather than automated string sanitization.
- [EXTERNAL_DOWNLOADS]: The skill automates the acquisition of research materials from remote sources.
- Evidence: Instructions in project-workflow.md and SKILL.md direct the agent to clone official code repositories and download supplementary PDFs from arXiv and author project pages.
- Mitigation: The skill explicitly forbids automatic installation or execution of downloaded code and weights, limiting the scope to acquisition only.
- [COMMAND_EXECUTION]: The skill performs shell-level operations for repository management and file organization.
- Evidence: Usage of git clone, environment variables like GIT_LFS_SKIP_SMUDGE=1, and directory manipulation commands to organize the related_work/ and source/ hierarchies.
Audit Metadata