grep-research-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js utility scripts (
update-check.js,auth.js,grep-api.js) to handle authentication status, check for updates, and communicate with the research API. It also uses inline Node.js commands to safely parse JSON response data.- [DYNAMIC_EXECUTION]: The script dynamically calculates the location of its helper scripts by resolving the physical path of the SKILL.md file and navigating the directory structure.- [PERSISTENCE_MECHANISMS]: For high-effort research tasks that can take up to an hour, the skill utilizes a loop mechanism to periodically poll the API for completion, maintaining state across the extended execution period.- [EXTERNAL_DOWNLOADS]: A background script namedupdate-check.jsis executed, which typically indicates a mechanism for verifying or fetching the latest versions of the tool's components from the vendor's infrastructure.- [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external research jobs, which is then used to refine subsequent research steps and presented to the end user. * Ingestion points: Research orientation reports and deep-dive findings are fetched via API result calls in SKILL.md. * Boundary markers: The instructions do not define specific text delimiters for the ingested report content before it is processed by the agent. * Capability inventory: The skill has the ability to execute local scripts, perform network operations via the API helper, and schedule recurring tasks. * Sanitization: The skill usesJSON.parsevia a Node.js one-liner to safely extract identifiers from API responses, preventing shell injection from malformed JSON data.
Audit Metadata