lit-sync
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted bibliographic metadata from external .bib files and the PubMed API, which is then used to populate Obsidian literature and concept notes. Malicious content within these files could potentially influence agent behavior during summarization or concept extraction.
- Ingestion points: Reads .bib files, project worklists (.tsv, .csv, .md), and JSON responses from the PubMed eutils API (eutils.ncbi.nlm.nih.gov).
- Boundary markers: External data is interpolated directly into Markdown templates in SKILL.md and references/locale/ko/note_templates.md without specific security delimiters or 'ignore' instructions.
- Capability inventory: The skill possesses file-writing capabilities (Write tool) and shell access (Bash tool for curl/grep) which could be targeted by a successful injection.
- Sanitization: Relies on regex-based extraction of specific fields (DOI, title, authors) which provides basic structural validation but does not sanitize against semantic prompt injection payloads.
- [COMMAND_EXECUTION]: The skill performs shell operations and network requests as part of its core functionality.
- Evidence: Uses curl to query the local Zotero/Better BibTeX API (127.0.0.1:23119) and the PubMed API for metadata retrieval.
- Context: These actions are limited to well-known research infrastructure and local services, following the least-privilege principles documented in the skill's safety rules.
Audit Metadata