arbor
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to iteratively modify and execute research artifacts (code, scripts, configurations). This creates an attack surface where instructions embedded in artifacts could influence agent behavior.
- Ingestion points: The skill ingests initial materials (M_0) and research evidence/insights returned by subagents as described in references/executor-brief.md.
- Boundary markers: The instructions mandate the use of isolated git worktree environments for all experiments to prevent contamination. State is managed via a dedicated .arbor/ directory with structured JSON.
- Capability inventory: The agent utilizes Bash and Write tools to execute the scripts/tree.py manager, perform Git operations, and run user-defined evaluation commands.
- Sanitization: The tree.py script uses standard json library for state persistence. Evaluation scores are validated to be finite numbers to prevent injection of malformed data into metrics.
- [COMMAND_EXECUTION]: The skill coordinates the execution of user-defined commands for development and test evaluation (e.g., python eval.py). These commands are executed against the artifact being optimized, which may contain agent-generated modifications.
- [EXTERNAL_DOWNLOADS]: The documentation in references/arbor-upstream.md provides instructions for installing the optional arbor-agent package via uv tool install. This is a versioned installation (0.1.4) of the upstream research tool referenced in the methodology.
Audit Metadata