alterlab-literature-review
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its data ingestion pipeline. It retrieves and processes untrusted content (titles and abstracts) from external academic databases such as PubMed and arXiv, which is then directly embedded into markdown documents.\n
- Ingestion points: Search results processed by
scripts/search_databases.pyand metadata fetched byscripts/verify_citations.py.\n - Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded prompts within the external data.\n
- Capability inventory: The skill uses the
Bashtool and executes document processing commands (pandoc,xelatex) throughscripts/generate_pdf.py.\n - Sanitization: There is no implementation of content sanitization or validation for the metadata retrieved from remote services.\n- [COMMAND_EXECUTION]: The
scripts/generate_pdf.pyscript executes thepandocutility viasubprocess.run. Although it uses a list-based argument structure to prevent direct shell injection, the complexity of the PDF generation engine presents a secondary attack surface if combined with successful prompt injection.
Audit Metadata