ara-research-manager
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a shell command to initialize the project directory structure.
- Evidence: The
SKILL.mdfile contains a bash block usingmkdir -p ara/{...}to create the required folders for research logging. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process the entire conversation history, which is considered untrusted data.
- Ingestion points: The
SKILL.mdfile andreferences/session-protocol.mdinstruct the agent to "Review the conversation history — scan everything that happened this session." - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings to separate user content from the agent's metadata extraction logic during the review phase.
- Capability inventory: The agent possesses file system write capabilities to create the
ara/directory and append content to various markdown and YAML files within it. - Sanitization: No sanitization or validation of the extracted conversation content is performed before writing it to the
ara/directory.
Audit Metadata