formulate-hypotheses
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user observations and research gaps, which creates a surface for indirect prompt injection.
- Ingestion points: Untrusted input is received through the
research_gap_or_observationfield defined in themode_contractswithinSKILL.md. - Boundary markers: The protocol lacks explicit instructions for using delimiters or boundary markers to isolate user-provided data from the agent's reasoning logic.
- Capability inventory: The skill's capabilities are restricted to internal reasoning processes and the loading of other instructional skills (e.g.,
identify-variables,score-object); no tools for network access, file system modification, or command execution are present. - Sanitization: There is no evidence of input validation, filtering, or sanitization logic to mitigate malicious instructions embedded in the input observations.
Audit Metadata