novelty-check
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input ($ARGUMENTS) describing a research method and interpolates it into instructions for tools and sub-agents, creating a vulnerability to indirect prompt injection.\n
- Ingestion points: User-provided research method descriptions enter the skill context via the
$ARGUMENTSplaceholder and are processed in Phases A and C.\n - Boundary markers: The workflow for the
spawn_agentcall in Phase C structures the prompt into logical sections, but lacks strict delimiters or safety instructions (e.g., "treat the following as data only") to prevent instructions embedded within the user's research description from overriding the reviewer's directives.\n - Capability inventory: The skill has access to
WebSearchandWebFetchfor network-based literature review,spawn_agentfor multi-agent reasoning, and performs file-write operations to save execution traces in the.aris/traces/directory.\n - Sanitization: There is no evidence of input validation, escaping, or sanitization of the research description before it is utilized by the agent or passed to the reviewer model.
Audit Metadata