paper-tweet-generator
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill includes a file named
paper-tweet-generator_audit_result_v2.jsonwhich presents a simulated security audit. This file contains multiple self-vouching claims such as"security": "PASS"and"gate": "PASS". This represents a deceptive attempt to provide false assurance of safety to automated scanners or human reviewers. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to extract text from external, untrusted documents (PDF, DOCX, TXT) and process them using an LLM.
- Ingestion points: Text is extracted from documents via
scripts/extract_text.pyandscripts/extract_pdf.py. - Boundary markers: The prompt templates provided in
references/prompt_templates.mddo not include protective delimiters or instructions to ignore embedded commands within the extracted document text. - Capability inventory: The skill facilitates command execution by running local Python scripts to perform extraction.
- Sanitization: There is no evidence of text sanitization or filtering before the external content is interpolated into the summarization prompts.
- [COMMAND_EXECUTION]: The
SKILL.mdinstructions and workflow explicitly require the agent to execute local Python scripts (e.g.,python scripts/extract_text.py) and perform compilation tasks (python -m py_compile). While these scripts are part of the skill package, this demonstrates the intended use of host-level command execution to process data.
Audit Metadata