papers
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from academic sources, creating a surface for indirect prompt injection.
- Ingestion points: External PDF documents and metadata retrieved from arXiv, Semantic Scholar, Unpaywall, CORE, and PubMed Central as described in
SKILL.md. - Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore embedded instructions' warnings when processing the converted markdown content.
- Capability inventory: The skill utilizes the
convert_to_markdowntool (via theleyline:document-conversiondependency) and theReadtool to extract information from documents. - Sanitization: There are no explicit instructions for sanitizing or filtering the content extracted from external PDFs before it is processed by the agent.
Audit Metadata