tooluniverse-literature-deep-research
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill introduces an attack surface for indirect prompt injection via external literature and document ingestion.
- Ingestion points: Located in
SKILL.mdunder the Phase 2.3 section (Full-Text Verification Strategy), where the agent retrieves full-text articles and external data using tools such asEuropePMC_search_articles,SemanticScholar_get_pdf_snippets,ArXiv_get_pdf_snippets, andget_webpage_text_from_url. - Boundary markers: Absent. The strategy lacks clear containment instructions or strict prompt boundaries that isolate downloaded text, meaning instructions embedded inside research papers could influence model reasoning.
- Capability inventory: Across the skill files, the capabilities are limited to reading data via external APIs and writing markdown and JSON/CSV files (such as
[topic]_report.mdand[topic]_bibliography.json). There are no capabilities for system command execution or shell scripting. - Sanitization: Absent. The retrieved text data from research databases and arbitrary URLs is directly interpolated into the synthesis and theme extraction phases without sanitization or structural validation.
Audit Metadata