revise
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from reviewer decision letters and manuscript files, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the data could influence agent behavior.
- Ingestion points: The agent ingests untrusted text and PDF content via the
reviewer_commentsandmanuscript/manuscript.mdinputs. - Boundary markers: The instructions lack explicit delimiters or system-level directives to ignore instructions embedded within the processed text, increasing the risk that the agent may follow adversarial commands contained in the reviewer comments.
- Capability inventory: The skill possesses significant capabilities, including executing local Python scripts, writing to the local file system (revision and manuscript directories), and delegating tasks to other tools for statistics, figures, and reference management.
- Sanitization: No sanitization or filtering logic is present to identify or remove instructional content from the ingested reviewer comments before processing.
Audit Metadata