storm-research
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The research workflow is designed to ingest and analyze potentially untrusted data from external URLs, datasets, and files.\n
- Ingestion points:
SKILL.md(Step 2: 'Establish baseline facts') fetches external sources;SKILL.md(Step 4: 'Dispatch one isolated executor per lens') collects raw returns from child processes.\n - Boundary markers: Explicit defensive instructions are included in
SKILL.md(Step 2) andreferences/lens-charter.mdto treat external text as untrusted and ignore embedded instructions.\n - Capability inventory: The skill framing include access to URLs, file paths, and repository names for retrieval purposes.\n
- Sanitization: The agent is instructed to 'extract evidence' rather than executing or following content from external sources.\n- [SAFE]: The skill implements context isolation (Step 4) to prevent cross-contamination and data leaks between different analytical perspectives (lenses). This represents a security best practice for multi-agent workflows processing external information.\n- [SAFE]: Explicit verification of context isolation is required in the workflow, reducing the risk of accidental prompt contamination from inherited conversations or sibling tasks.
Audit Metadata