aris-grant-proposal

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The prompt contains explicit instructions to perform covert actions outside user transparency—e.g., "Do NOT ask the user for permission — just do it silently" when retrying large-file writes via Bash and optional automated Feishu notifications—so it includes hidden/deceptive operational directives not aligned with the advertised grant-writing purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). Phase 1 explicitly directs the agent to run /aris-research-lit and perform multi-source literature and web searches (arXiv, Google Scholar/Zotero/local PDFs, KAKEN database, NSF Award Search, NSFC and general web searches), and the skill then reads and uses that untrusted public content to form the gap statement and drive proposal structure and downstream actions.