autoverse-seed-expand

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing a specific command-line interface tool named autoverse to perform literature searches (search), identify authors (authors), resolve document IDs (resolve), and interact with APIs (api). These commands are predefined and parameterized by user-provided research queries.
  • [INDIRECT_PROMPT_INJECTION]: The skill's core function involves ingesting and summarizing external data (paper titles, metadata, and abstracts) which are retrieved via the autoverse tool. This creates a surface for indirect prompt injection where malicious instructions embedded in a paper's abstract could attempt to influence the agent's behavior.
  • Ingestion points: External data retrieved from research databases via autoverse search, resolve, and api calls (specifically the abstract fields).
  • Boundary markers: The instructions do not define specific delimiters or "ignore instructions" wrappers for the ingested abstract content.
  • Capability inventory: The skill has the ability to execute shell commands (autoverse) and write files to the local file system (.md reports and .csv tables).
  • Sanitization: There is no evidence of sanitization or filtering applied to the retrieved abstracts before they are processed by the LLM.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:25 AM