research-grants

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requests access to the Bash tool in its configuration. In SKILL.md, it provides instructions for executing a Python script (scripts/generate_schematic.py) to generate diagrams from natural-language descriptions. This script is part of a referenced external skill (scientific-schematics).
  • [PROMPT_INJECTION]: The skill acts as a data ingestion point for untrusted user research information which is then processed into grant templates. There is a potential surface for indirect prompt injection as the skill lacks explicit instructions for the agent to use boundary markers or delimiters when handling user input, though this is considered a low-severity architectural risk in an educational context.
  • [EXTERNAL_DOWNLOADS]: The documentation in references/nstc_guidelines.md suggests that users download LaTeX templates and packages from public repositories, specifically GitHub and CTAN. These are well-known academic resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 11:09 AM