academic-paper
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by processing untrusted user content across a multi-agent team without adequate isolation.
- Ingestion points: Phase 1 of the workflow extracts research topics and materials from user input and copies existing files (data, drafts, literature) into the
_workspace/directory for processing. - Boundary markers: The instructions do not define specific delimiters (such as XML tags or unique markers) or include 'ignore embedded instructions' warnings for agents when they read the contents of the
_workspace/directory. - Capability inventory: The agents involved in the pipeline possess file system write permissions for the
_workspace/directory and have roles that include code generation (statistical-analyst), which could be manipulated by injected instructions. - Sanitization: No sanitization, validation, or filtering of the external research materials is specified before the content is interpolated into the agent context for analysis and manuscript writing.
Audit Metadata