review-ml-experiment
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to fetch and follow recommendations from an external URL found within the experiment's digest files. This creates a surface for indirect prompt injection where a malicious URL or content at that URL could influence the agent's output.
- Ingestion points: Documentation URLs extracted from
scratch/audit/<stem>/audit.md(the digest). - Boundary markers: None identified; instructions do not specify delimiters or warnings to ignore embedded instructions in the fetched content.
- Capability inventory: File system modification (
journal/ideas/*.md,JOURNAL.md) and shell command execution (python -m skore_skills). - Sanitization: None identified; the agent is directed to directly apply the page's recommendations.
- [COMMAND_EXECUTION]: The skill executes local shell commands via the
python -m skore_skillsinterface to retrieve status, consent, findings, and locators. These commands use a variable<stem>which represents the experiment identifier. While this is a vendor-provided tool, it involves subprocess execution based on environment variables.
Audit Metadata