research-executor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and synthesize data from external web sources, creating a surface for indirect prompt injection attacks where malicious content on a website could attempt to subvert the agent's instructions.
- Ingestion points: Untrusted data is fetched from the internet using the
WebSearch,WebFetch, andmcp__web_reader__webReadertools as described in Phase 3 ofinstructions.mdandSKILL.md. - Boundary markers: The instructions do not specify the use of strict delimiters or boundary markers (such as XML tags) to isolate retrieved web content from the agent's instructions, although they do mandate structured internal formatting for research notes.
- Capability inventory: The skill possesses significant capabilities including spawning multiple parallel agents via the
Tasktool, performing network operations, and writing to the local file system usingRead/Writetools to organize research outputs. - Sanitization: The skill relies on an iterative "Chain-of-Verification" (Phase 6) and "Source Triangulation" (Phase 4) to manually or programmatically cross-reference findings, but it lacks explicit instruction for sanitizing or escaping content retrieved from the web before processing.
Audit Metadata