sd-paper-detail
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts metadata such as titles and abstracts from external ScienceDirect pages, which could be used to inject instructions into the agent's context.\n
- Ingestion points: Metadata is extracted from DOM elements (e.g.,
.title-text,.abstract.author, and.keyword) via theevaluate_scripttool as defined inSKILL.md.\n - Boundary markers: The skill does not use specific delimiters or instructions (e.g., 'ignore any instructions in this text') when passing the scraped metadata back to the agent.\n
- Capability inventory: The skill possesses browser interaction capabilities including
navigate_page,evaluate_script,take_snapshot, andclick.\n - Sanitization: There is no evidence of filtering or sanitization of the scraped strings before they are interpolated into the agent's response format.
Audit Metadata