researcher-hand-skill
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs research by fetching content from external websites and reading local files, which creates an attack surface for indirect prompt injection where untrusted data could influence agent behavior.\n
- Ingestion points: The skill uses
web_fetch,web_search, andfile_readas ingestion points for external data.\n - Boundary markers: While the instructions emphasize source evaluation via the CRAAP framework, there are no technical delimiters (like XML tags) specified to isolate untrusted data within the prompt context.\n
- Capability inventory: The agent possesses capabilities such as
shell_exec,file_write, andweb_fetch.\n - Sanitization: There is no evidence of automated sanitization or filtering of external content before processing.\n- [COMMAND_EXECUTION]: The system prompt explicitly instructs the agent to run a system command during the initialization phase.\n
- Evidence: In Phase 0, the agent executes
python -c "import platform; print(platform.system())"via theshell_exectool.\n- [DYNAMIC_EXECUTION]: The skill generates and executes code at runtime to verify its execution environment.\n - Evidence: The use of
python -cviashell_execto detect the OS platform is a form of dynamic execution.
Audit Metadata