agentic-research-workflow
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The research_agent implementation in src/agents.py uses the Python eval() function to process tool arguments generated by the LLM: arguments = eval(tool_call.function.arguments). Because the LLM's context contains unvalidated data fetched from the web (via Tavily and Wikipedia), an attacker could theoretically poison these sources to trick the model into producing a string that executes malicious code when evaluated.
- [EXTERNAL_DOWNLOADS]: The skill's setup process involves cloning an external GitHub repository: git clone https://github.com/https-deeplearning-ai/agentic-ai-public.git. While this repository belongs to a known organization, downloading and running external code at runtime carries inherent risks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple external sources, creating an attack surface for indirect prompt injection. 1. Ingestion points: The research_tools.py file contains functions that fetch data from Tavily (web search), arXiv (academic papers), and Wikipedia. 2. Boundary markers: No clear delimiters or safety markers are used when passing this external data to the writer_agent or editor_agent prompts. 3. Capability inventory: The agent can write to a PostgreSQL database and perform further tool calls based on context. 4. Sanitization: Content from external APIs is interpolated directly into prompt strings without sanitization or validation.
- [COMMAND_EXECUTION]: The installation instructions utilize shell commands for environment setup, including docker, git, and pip. Users should ensure the environment and external repositories are trusted before execution.
Audit Metadata