deep-research
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize data from the live web, creating a surface for indirect prompt injection attacks where malicious instructions hidden in external web pages could influence the agent's research conclusions or subsequent tool usage.
- Ingestion points: External data enters the agent context through web search results and the fetching of full-text articles as defined in the investigation phase (P2) of SKILL.md and the subagent investigation rules in references/subagent-prompt.md.
- Boundary markers: The workflow utilizes a structured transition from raw search results to research notes (references/research-notes-format.md), and subsequently to a citation registry (registry.md), providing multiple layers of abstraction that can mitigate but not fully prevent the impact of embedded instructions.
- Capability inventory: The skill possesses the capability to perform broad web searches, read/fetch external URL content, and write multiple markdown and JSON artifacts to the local workspace.
- Sanitization: The provided instructions and scripts do not implement specific sanitization, escaping, or filtering of fetched web content before it is processed by the model for synthesis.
Audit Metadata