research-orchestrator

Warn

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using user-provided research topics as arguments, specifically seen in python bin/progress_tracker.py init --topic "<TOPIC>" and python "scripts/generate_hitl_checklist.py" --project-title "<TOPIC>". This pattern is vulnerable to command injection if the input contains shell metacharacters like semicolons or pipes.- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to its extensive processing of untrusted data.
  1. Ingestion points: User-provided research ideas, metadata extracted from academic literature (Phase 3), and datasets retrieved via web scraping or APIs (Phase 2).
  2. Boundary markers: The instructions lack explicit delimiters or instructions to treat external data as untrusted, increasing the risk that the agent may follow instructions embedded in retrieved content.
  3. Capability inventory: The skill has high privileges, including executing data analysis scripts, modifying the user_profile.json file, and writing to progress.json and hitl_research_checklist.md.
  4. Sanitization: No sanitization or validation processes are described for data fetched from external sources before it influences subsequent logic or script execution.
  • [COMMAND_EXECUTION]: The orchestration workflow involves calling multiple scripts with potentially unvalidated inputs, which could lead to unauthorized file system modifications or process manipulation if the sub-skills do not handle arguments securely.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 28, 2026, 12:50 PM
Security Audit — agent-trust-hub — research-orchestrator