research-workflow-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill coordinates workflow stages by invoking the research-hub CLI and various MCP tool adapters. These executions are scoped by a state machine that enforces human decision gates for any non-read-only or non-reversible actions.
- [INDIRECT_PROMPT_INJECTION]: The skill manages a pipeline that processes data from scholarly sources, which presents a potential surface for indirect prompt injection. Evidence chain: 1. Ingestion points: Data enters via literature-triage-matrix, arXiv, Semantic Scholar, Crossref/OpenAlex, Zotero, and NotebookLM. 2. Boundary markers: The skill uses a structured Human Decision Packet and a dedicated human gate registry to delimit automated transitions. 3. Capability inventory: Includes CLI tool execution (research-hub), local filesystem writes for state/artifacts, and human-gated external writes to reference tools. 4. Sanitization: Employs deterministic validators, source-grounded synthesis verifiers, and mandatory human semantic review gates before advancing research stages.
- [EXTERNAL_DOWNLOADS]: The skill fetches metadata from established scholarly APIs and services including arXiv, Semantic Scholar, Crossref, OpenAlex, and Zotero. These are recognized services used for research discovery, and all interactions are limited to read-only operations or mutations that require explicit human authorization.
Audit Metadata