research-deep
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads from an external outline file (
outline.yaml) and interpolates untrusted fields like{item_related_info}and{item_name}directly into the prompt template for downstream sub-agents. If an attacker controls the content within the outline, they can craft malicious payload structures designed to compromise or redirect the downstream agent's execution. - [COMMAND_EXECUTION]: The workflow specifies executing a validation script (
python ~/.codex/skills/research/validate_json.py) via the terminal context to verify the integrity of the generated JSON output.
Audit Metadata