run-research-and-save-files
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a shell script (
scripts/init-corpus.sh) for initializing the research environment. This script is used to create directories and boilerplate files. It includes a security check (is_slug) that validates input arguments against a strict kebab-case regular expression, preventing potential command injection via user-controlled strings. The file creation logic usesprintfwith literal strings, ensuring that content is not interpreted by the shell. - [PROMPT_INJECTION]: The skill manages a multi-agent workflow that ingests untrusted data from web sources, constituting an indirect prompt injection surface. This is the primary function of the tool. The skill incorporates several architectural safeguards: subagents are isolated via disjoint filesystem write scopes, read scopes are restricted to prevent context leakage between agents, and the final synthesis is performed by a central orchestrator that reviews all collected evidence. The skill also enforces strict citation and verification rules to identify contradictions or missing data.
Audit Metadata