extraction-form
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script dynamically modifies the python system path to resolve and load local modules at runtime.
- Evidence: In
scripts/run.py, the code traverses parent directories to locate a repository root marker (AGENTS.md) and inserts the discovered path intosys.pathto enable imports from a localtoolingdirectory. - [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from research paper logs and abstracts, which serves as an ingestion point for indirect prompt injection.
- Ingestion points: The script reads paper metadata (titles, abstracts) from
papers/screening_log.csvand protocol definitions fromoutput/PROTOCOL.mdinscripts/run.py. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions embedded within the paper metadata.
- Capability inventory: The skill is restricted to reading and writing local CSV and Markdown files. It does not possess network access, system command execution, or subprocess capabilities.
- Sanitization: The data is processed using basic regular expressions for metadata extraction but lacks specific sanitization or escaping for downstream LLM processing.
Audit Metadata