agentic-research-agent-fastapi
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation guides the user to clone source code from 'https://github.com/https-deeplearning-ai/agentic-ai-public.git'. This repository and its owner are not recognized trusted vendors; the 'https-' prefix is a suspicious naming convention often associated with impersonation or typosquatting attempts.
- [COMMAND_EXECUTION]: The installation steps include 'git clone', 'docker build', and 'docker run' commands. This workflow grants the agent the ability to fetch and execute arbitrary code from an untrusted external source within the host's container environment.
- [INDIRECT_PROMPT_INJECTION]: The FastAPI implementation exposes an endpoint that processes user-supplied research prompts. These prompts are directly interpolated into the agent's planning logic without visible delimiters or sanitization, creating a significant attack surface.
- Ingestion points: The 'prompt' parameter in the '/generate_report' POST request within 'main.py'.
- Boundary markers: No delimiters or 'ignore instructions' warnings are present in the code snippets for prompt interpolation.
- Capability inventory: The agents have access to web searches (Tavily), academic papers (arXiv), and database persistence (SQLAlchemy).
- Sanitization: While noted as a best practice in the text, the actual implementation logic lacks sanitization or validation of the input prompt.
Recommendations
- AI detected serious security threats
Audit Metadata