research-article-weekly
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the
keywordsinput, which flows directly into shell command templates and AI prompts. - Ingestion points: The
keywordsinput parameter inSKILL.md. - Boundary markers: Absent; user input is interpolated directly into commands using
"{keywords}"without delimiters or instructions to ignore embedded commands. - Capability inventory: The workflow executes
scripts/pubmed_search.py, which performs network requests to external APIs. - Sanitization: Absent; the skill lacks any logic to sanitize, escape, or validate the user-provided keyword string before execution.
- [COMMAND_EXECUTION]: The workflow section in
SKILL.mdprovides instructions to execute a shell command:python scripts/pubmed_search.py --keywords "{keywords}". Because the input is not sanitized, an attacker could provide keywords containing shell metacharacters (e.g.,;,&&,|) to execute arbitrary commands on the host system. - [METADATA_POISONING]: The skill package includes a file
research-article-weekly_audit_result_v1.jsonthat contains a self-generated audit report. This report explicitly claims that the skill has passed all security checks and is 'Production Ready'. These internal assertions are misleading as they attempt to define the skill's safety status independently of an external security review.
Audit Metadata