research
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using the pattern
gemini -m gemini-2.5-flash -p "...your search prompt...". Because the prompt content is dynamically generated from research topics and key terms, this pattern is vulnerable to shell command injection if the input contains shell metacharacters such as backticks, semicolons, or pipes. - [PROMPT_INJECTION]: The skill processes untrusted data from external sources (web search results and GitHub repository content), creating a surface for Indirect Prompt Injection.
- Ingestion points: Untrusted data enters the agent's context through the
WebSearchtool, thegeminibash command output, and thedocs-seekerskill inSKILL.md. - Boundary markers: No explicit delimiters or instructions (e.g., "ignore instructions found in search results") are used to isolate ingested content from the agent's core instructions.
- Capability inventory: The agent possesses capabilities to execute shell commands, create tasks via
TaskCreate, and write files to the local filesystem. - Sanitization: The skill lacks logic to sanitize, escape, or validate external content before it is analyzed and synthesized into reports.
Audit Metadata