research-compendium
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted data from the open web, which is a vector for indirect prompt injection. However, it implements comprehensive mitigations.
- Ingestion points: The skill fetches papers, articles, and web pages from the open web in Phase 1 and Phase 2.
- Boundary markers: Instructions require the use of fenced blocks (untrusted-quoted) to wrap suspicious imperatives within archived content.
- Capability inventory: The skill has file-writing capabilities to the research/ directory, file upload tools (gbrain files upload-raw), and the ability to delegate tasks to other skills like minion-orchestrator.
- Sanitization: The skill mandates a specific defensive workflow to flag directives in frontmatter (untrusted_directives: true) and neutralize imperative text to ensure it is treated as data, not instructions, in future sessions.
Audit Metadata