academic-deep-research
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves fetching external web content via
web_fetch, which exposes the agent to indirect prompt injection if retrieved pages contain malicious instructions. - Ingestion points: Content is retrieved using
web_fetchduring the investigation cycles described inreference/protocol.mdandSKILL.md. - Boundary markers: The skill lacks explicit instructions to wrap external content in delimiters or include 'ignore embedded instructions' warnings when processing fetched data.
- Capability inventory: The agent has access to
web_search,web_fetch, andsessions_spawnfor executing its research tasks. - Sanitization: There is no explicit requirement for the agent to sanitize or filter the content retrieved from external URLs before synthesis.
- Mitigation: The risk is inherent to web research; however, the skill's structured methodology—which requires analysis between tool calls and explicit user approval of the research plan—provides human oversight and reduces the likelihood of automated obedience to injected instructions.
Audit Metadata