arxiv
Fail
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading PDF documents from
arxiv.org, a well-known academic service. While automated scans may flag these patterns as potential remote code execution vectors, the skill instructions focus on document retrieval and do not include commands to execute the downloaded files.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and displays unvetted metadata (titles and abstracts) from the arXiv API. An attacker could potentially embed malicious instructions in a paper's metadata to influence the agent's behavior during a research task.\n - Ingestion points: Academic paper metadata (titles, summaries, and IDs) retrieved from the
export.arxiv.orgAPI (processed in SKILL.md).\n - Boundary markers: No delimiters or 'ignore instructions' warnings are present in the prompt templates to isolate the paper content from system instructions.\n
- Capability inventory: The skill can perform network operations via
curland Python'surllib, and it can write files to the local system usingcurl -o(SKILL.md).\n - Sanitization: The Python parsing examples include basic truncation of summary text but do not perform sanitization, escaping, or validation of the retrieved content.
Recommendations
- HIGH: Downloads and executes remote code from: https://arxiv.org/pdf/2401.01234.pdf - DO NOT USE without thorough review
Audit Metadata