research-orchestrator
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using user-provided research topics as arguments, specifically seen in
python bin/progress_tracker.py init --topic "<TOPIC>"andpython "scripts/generate_hitl_checklist.py" --project-title "<TOPIC>". This pattern is vulnerable to command injection if the input contains shell metacharacters like semicolons or pipes.- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to its extensive processing of untrusted data.
- Ingestion points: User-provided research ideas, metadata extracted from academic literature (Phase 3), and datasets retrieved via web scraping or APIs (Phase 2).
- Boundary markers: The instructions lack explicit delimiters or instructions to treat external data as untrusted, increasing the risk that the agent may follow instructions embedded in retrieved content.
- Capability inventory: The skill has high privileges, including executing data analysis scripts, modifying the
user_profile.jsonfile, and writing toprogress.jsonandhitl_research_checklist.md. - Sanitization: No sanitization or validation processes are described for data fetched from external sources before it influences subsequent logic or script execution.
- [COMMAND_EXECUTION]: The orchestration workflow involves calling multiple scripts with potentially unvalidated inputs, which could lead to unauthorized file system modifications or process manipulation if the sub-skills do not handle arguments securely.
Audit Metadata