food-research
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several Python scripts included in the package to manage workflow state and data integrity. These include
scripts/food_fetch_setup.pyfor initialization,scripts/fetch_oa.pyandscripts/resolve_oa.pyfor retrieving open-access papers, andscripts/verify_citations.pyfor auditing references. It also utilizespandocor adocxtool to export research findings into Microsoft Word format. - [EXTERNAL_DOWNLOADS]: The skill connects to established academic and regulatory services to retrieve research data. This includes bibliographic searching through PubMed (NCBI), CrossRef, OpenAlex, and Semantic Scholar, as well as accessing preprint servers like bioRxiv and ChemRxiv. It also interacts with safety and regulatory bodies such as EFSA and the FDA for regulatory data retrieval. Additionally, the skill downloads open-access full-text PDFs from mirror sites like Europe PMC when available.
- [PROMPT_INJECTION]: As the skill is designed to ingest and synthesize large quantities of external literature and search result snippets, it possess an indirect prompt injection surface. This risk is mitigated by a specialized
reviewersubagent that performs editorial and integrity checks on the generated content, and asynthesisagent that evaluates source quality and replication factors before final delivery. - [DATA_EXFILTRATION]: To perform full-text analysis of research articles, the skill requests read-only access to user-defined folders containing PDFs (such as EndNote or Zotero libraries). To prevent accidental disclosure of local metadata or system information, the skill utilizes a
scripts/privacy_scan.pytool to audit deliverables before they are presented to the user, identifying and removing local paths or secrets.
Audit Metadata