research-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs research by ingesting data from a wide variety of untrusted external sources, including company websites, LinkedIn profiles, Glassdoor reviews, Reddit threads, and job postings. This creates a surface for indirect prompt injection where an attacker could place malicious instructions in these publicly accessible locations to manipulate the agent's research findings or subsequent actions.
- Ingestion points: The workflow specifically instructs the agent to consult Google News, LinkedIn, Glassdoor, and job postings to identify tech stacks and market signals in files like
SKILL.mdandreference/market.md. - Boundary markers: While the skill provides structured templates for reports, it does not include explicit delimiters or instructions to ignore potential commands embedded in the ingested external text.
- Capability inventory: The agent has capabilities to write research reports, state files, and logs to the local filesystem (e.g.,
~/.claude/skill-state/research-skill/) and can interact with CRM tools to create contact notes or update selection guides. - Sanitization: The instructions do not define any sanitization or validation protocols for the content retrieved from web searches before it is synthesized into reports or written to persistent files.
Audit Metadata