grep-research-workflow

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Node.js utility scripts (update-check.js, auth.js, grep-api.js) to handle authentication status, check for updates, and communicate with the research API. It also uses inline Node.js commands to safely parse JSON response data.- [DYNAMIC_EXECUTION]: The script dynamically calculates the location of its helper scripts by resolving the physical path of the SKILL.md file and navigating the directory structure.- [PERSISTENCE_MECHANISMS]: For high-effort research tasks that can take up to an hour, the skill utilizes a loop mechanism to periodically poll the API for completion, maintaining state across the extended execution period.- [EXTERNAL_DOWNLOADS]: A background script named update-check.js is executed, which typically indicates a mechanism for verifying or fetching the latest versions of the tool's components from the vendor's infrastructure.- [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external research jobs, which is then used to refine subsequent research steps and presented to the end user. * Ingestion points: Research orientation reports and deep-dive findings are fetched via API result calls in SKILL.md. * Boundary markers: The instructions do not define specific text delimiters for the ingested report content before it is processed by the agent. * Capability inventory: The skill has the ability to execute local scripts, perform network operations via the API helper, and schedule recurring tasks. * Sanitization: The skill uses JSON.parse via a Node.js one-liner to safely extract identifiers from API responses, preventing shell injection from malformed JSON data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 09:40 PM
Security Audit — agent-trust-hub — grep-research-workflow