paper-writing-router
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute git commands (e.g., git rev-parse). This is used for repository discovery to determine the scope of the project. While legitimate, shell access remains a sensitive capability.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading external data from local files like memory/BRIEFING.md and paper/.agent/writing-contract.md to guide its routing logic. Without sanitization or boundary markers, malicious content within these files could potentially influence agent behavior.
- Ingestion points: memory/BRIEFING.md, paper/.agent/writing-contract.md (processed via the Read tool).
- Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore potential commands embedded in the data files.
- Capability inventory: Bash (shell access), Read (file system access).
- Sanitization: Absent. The content of the briefing files is used directly for task classification without validation or filtering.
Audit Metadata