novelty-check
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves external data from the web and processes it through a secondary reviewer model without implementing boundary markers or sanitization. This allows malicious instructions embedded in external content (e.g., in a paper abstract) to potentially influence the reasoning report.
- Ingestion points: Research paper abstracts and related work sections are fetched from external websites using
WebFetchin Phase B. - Boundary markers: The instructions do not specify any delimiters or explicit 'ignore instructions' warnings when passing the fetched web content to the
REVIEWER_MODELvia themcp__codex__codextool. - Capability inventory: The skill uses
WebSearch,WebFetch,Grep,Read,Glob, andmcp__codex__codexto read and process data across the file system and network. - Sanitization: There is no evidence of validation, escaping, or filtering of the external content retrieved via
WebFetchbefore it is interpolated into the reasoning prompt.
Audit Metadata