reference-verify
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from user-provided LaTeX (.tex) and BibTeX (.bib) files while possessing powerful capabilities such as file editing and command execution. A maliciously crafted paper could attempt to influence the agent's verification logic or drive unauthorized modifications to the manuscript.
- Ingestion points: Workflow Step 1 involves reading content from external .tex and .bib files.
- Boundary markers: The instructions do not define delimiters or specific safety prompts to prevent the agent from obeying instructions embedded within the processed manuscript files.
- Capability inventory: The skill uses the Edit tool to modify source files (Step 6) and the Bash tool to execute Python scripts and network commands.
- Sanitization: There is no evidence of sanitization or filtering applied to the manuscript content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill executes shell commands and Python scripts to perform its core functions.
- Evidence: Use of curl for API queries and pip for package installation within the workflow.
- Evidence: Execution of a Python script via Bash to generate a structured Excel report using a predefined template.
- [EXTERNAL_DOWNLOADS]: The skill connects to external repositories and services to verify data and manage dependencies.
- Evidence: Fetches metadata from the DBLP search API (dblp.org) and DOI resolvers (doi.org).
- Evidence: Installs the openpyxl library from a public package registry.
Audit Metadata