alterlab-paper-writer
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data through the literature_strategist_agent (which fetches external academic papers using WebSearch and WebFetch) and the revision_coach_agent (which parses user-provided reviewer comments). The instructions for these agents (in files agents/literature_strategist_agent.md and agents/revision_coach_agent.md) do not specify strict boundary delimiters or instructions to ignore embedded commands within the ingested content, creating a vulnerability where malicious instructions in external papers or reviews could influence the agent's behavior.
- [COMMAND_EXECUTION]: The formatter_agent utilizes the Bash tool to execute system commands for document processing. Specifically, the agent compiles LaTeX documents using the tectonic binary and converts files using pandoc (as specified in agents/formatter_agent.md). While these are legitimate academic tools, they involve executing shell commands on files that are partially derived from user-supplied data.
- [DYNAMIC_EXECUTION]: The visualization_agent generates runnable Python (matplotlib) and R (ggplot2) code for statistical charts based on data extracted from the paper. While the instructions in agents/visualization_agent.md suggest these scripts are delivered to the user, the presence of the Bash tool in the skill's allowed-tools list creates a surface for the potential execution of these dynamically generated scripts within the agent's environment.
Audit Metadata