update
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it loads historical research data (elicitation and findings) from state.json and interpolates it directly into the prompt of the research-orchestrator subagent.
- Ingestion points: The skill reads prior research state including findings and elicitation data from state.json using the Read tool.
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ELICITATION or PRIOR_STATE blocks in the Agent prompt definition.
- Capability inventory: The skill and its spawned subagents have access to powerful tools including Bash, Write, Agent, and TeamCreate.
- Sanitization: While user-supplied arguments are sanitized for length and specific characters, the data loaded from local state files (which originated from external research) is not sanitized or escaped before prompt interpolation.
- [COMMAND_EXECUTION]: The skill utilizes bash and jq to update session metadata in sigint.config.json. It follows best practices by using jq --arg to pass variables safely and includes specific instructions to sanitize user-provided arguments by truncating them to 200 characters and stripping backticks and angle brackets to mitigate shell injection risks.
Audit Metadata