ara-research-manager
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands (
mkdir -p) to initialize the directory structure for its research artifacts. This is a routine operation for its stated function of managing project documentation. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted data from the conversation history.
- Ingestion points: Extracts information from the full conversation history and existing project files in the
ara/directory. - Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded in the processed history.
- Capability inventory: Accesses the file system to read and write Markdown/YAML files and create directories via shell commands.
- Sanitization: There is no evidence of sanitization or filtering of the ingested conversation data before it is rewritten into project files.
Audit Metadata