loop-research
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external information from the workspace, including project evidence, experiment harnesses, and documentation, to drive its research funnel and author artifacts. This ingestion of untrusted local data represents a potential surface for indirect prompt injection, although the skill implements specific 'Method guards' and a 'Supervisor' audit role to verify the integrity of the results.
- Ingestion points: The skill inspects the workspace for existing evidence, experiment harnesses, and data policies (SKILL.md).
- Boundary markers: The skill relies on structured logic defined in 'preset.md' but does not implement explicit delimiters or 'ignore' instructions for untrusted workspace data.
- Capability inventory: The skill is restricted to reading workspace files and authoring new artifacts via referenced local templates; it is explicitly configured to disable model invocation and avoid executing generated nodes.
- Sanitization: No explicit string-level sanitization for ingested data is documented; security relies on logic-based guards, manual interview confirmation, and supervisor review.
Audit Metadata