gs-cited-by
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external sources (Google Scholar search results) which could theoretically contain malicious instructions.
- Ingestion points: Paper titles, authors, and snippets are scraped from the Google Scholar results page in
SKILL.md(Step 3). - Boundary markers: None identified in the provided extraction script.
- Capability inventory: The skill utilizes
mcp__chrome-devtools__navigate_pageandmcp__chrome-devtools__evaluate_scriptto interact with the web browser. - Sanitization: The extracted text is returned directly as a JSON object without explicit sanitization or filtering of embedded instructions.
- [COMMAND_EXECUTION]: The skill dynamically constructs a URL using user-provided input ($ARGUMENTS) in Step 2.
- Evidence: The URL
https://scholar.google.com/scholar?cites={DATA_CID}&hl=en&num=10is built by interpolating theDATA_CIDvariable, which may be derived directly from user input.
Audit Metadata