arbor
Warn
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in
references/arbor-upstream.mdsuggests that users clone and install a third-party tool fromgithub.com/RUC-NLPIR/Arbor. This repository is not verified as a trusted source within the internal safety framework.\n- [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting and processing data from external sources, such as artifact code and evaluator outputs, which serves as a surface for indirect prompt injection.\n - Ingestion points: The coordinator agent processes research insights and artifacts produced by executor sub-agents, as well as logs from development and test evaluation scripts.\n
- Boundary markers: No explicit delimiters or safety instructions are defined to separate untrusted data from the agent's decision-making logic in the
scripts/tree.pymanager.\n - Capability inventory: The skill utilizes powerful tools including
Bash,Agent(for sub-agent orchestration),Read,Write, andEdit.\n - Sanitization: The system lacks validation or sanitization of research insights before they are abstracted and propagated up the hypothesis tree.
Audit Metadata