researchwrite

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python utility script scripts/build_proposal_docx.py. Analysis of the script confirms it is a legitimate file converter that transforms Markdown text into formatted .docx files using the python-docx library. The script performs localized file I/O and standard text processing without any execution of external commands or shell interaction.
  • [EXTERNAL_DOWNLOADS]: The skill requires the python-docx Python package for document generation. This is a widely used, reputable library for document manipulation. No other external dependencies, remote scripts, or unverified binaries are referenced or downloaded.
  • [DATA_EXFILTRATION]: All file operations are scoped to a local working directory (<outputs>/researchwrite/). The skill does not contain any code or instructions for network requests, remote data transmission, or access to sensitive system paths like SSH keys or environment secrets.
  • [PROMPT_INJECTION]: The instructions reinforce scientific integrity and evidence-based writing. There are no patterns suggesting attempts to override model safety guidelines or extract system prompts. The skill uses 'foundation files' to bound the agent's context and prevent the fabrication of data.
  • [DYNAMIC_EXECUTION]: While the skill manages a complex state machine, it does not use eval(), exec(), or dynamic code assembly from user-provided data. The Python conversion script is static and follows a predefined parsing logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 02:52 AM
Security Audit — agent-trust-hub — researchwrite