start-research
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs (venue aims and scope pages) to specialize the reviewer agent's persistent memory, creating an injection surface.
- Ingestion points:
phases/05-venue-scope-seed.mdfetches content from external, potentially attacker-controlled URLs. - Boundary markers: Absent. The raw web content is interpolated directly into a processing prompt without delimiters or 'ignore instructions' wrappers.
- Capability inventory: The skill writes to agent memory files (
.omx/omxr/agent-memory/reviewer/MEMORY.md) and delegates to other project initialization skills. - Sanitization: Absent. The skill does not perform validation or sanitization of the fetched content before it is processed by the language model.
- [EXTERNAL_DOWNLOADS]: The skill initiates network operations to retrieve venue-specific metadata from external websites.
- Evidence:
phases/05-venue-scope-seed.mdperforms web fetches of author guidelines and scope pages from user-provided or registry-sourced URLs.
Audit Metadata