research-atlas-site
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a data-driven pipeline that ingests, normalizes, and enriches research records from external sources (e.g., arXiv abstracts, PDF metadata, and remote resource links). This architecture creates a surface for indirect prompt injection where malicious instructions embedded in scholarly metadata could influence the agent during site generation or auditing tasks.
- Ingestion points: Research records stored in structured YAML/JSON/Markdown frontmatter and remote enrichment data fetched during the build process (referenced in
SKILL.mdandreferences/digital-humans-reference.md). - Boundary markers: While the skill emphasizes structured data and stable identifiers, it does not explicitly instruct the agent to use prompt delimiters (like XML tags or triple backticks) when processing untrusted abstracts or summaries.
- Capability inventory: The skill outlines a build pipeline capable of generating pages, search indexes, statistics, and reusable exports (HTML/JSON/LaTeX).
- Sanitization: The skill includes defensive instructions to "Normalize, enrich, and validate records during the build" and "Validate required fields, dates, URLs, duplicate DOI/arXiv IDs, taxonomy values, and build output in CI," which provides a measure of protection against malformed or malicious data inputs.
Audit Metadata