agent-research-eval
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from external AI product interfaces to perform evaluations and synthesis. This creates a surface for indirect prompt injection where a candidate model could attempt to influence the local judge or the synthesis process through embedded instructions.\n
- Ingestion points: Captures assistant answers, reasoning modes, and citations from various AI web products (documented in SKILL.md and references/evaluation-protocol.md).\n
- Boundary markers: The protocol explicitly instructs the judge model to treat candidate text as "untrusted quoted content" and utilizes shuffled anonymous IDs to blind the judge to provider identities during scoring (references/evaluation-protocol.md).\n
- Capability inventory: The skill can write files and execute a local JavaScript renderer to produce HTML reports (scripts/render-report.mjs).\n
- Sanitization: The renderer implements comprehensive security controls, including strict HTML escaping of all user-supplied and model-supplied content, a safeUrl function that filters protocols and strips sensitive query parameters (such as tokens and keys), and a highly restrictive Content Security Policy (CSP) in the generated HTML reports to prevent script execution or data exfiltration.
Audit Metadata