workshop
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands and Python scripts using the
uv runutility to manage workflow gates, search for content usingrg, and perform file operations likemkdirandcp. - [COMMAND_EXECUTION]: Utilizes dynamic context injection (the
!syntax) inSKILL.mdto run a local initialization script (load-constraints.py) upon skill loading. - [PROMPT_INJECTION]: The skill ingests and extracts data from user-provided research papers (PDFs), creating a surface for indirect prompt injection where content within the papers could attempt to manipulate agent instructions.
- Ingestion points: Local research paper PDF files identified in Phase 1.
- Boundary markers: Employs targeted extraction goals for metadata and inventory rather than unconstrained reading.
- Capability inventory: Extensive file writing capabilities and the ability to execute local scripts and compilers.
- Sanitization: The workflow relies on structured extraction but does not explicitly demonstrate text escaping or sanitization of the extracted content.
- [COMMAND_EXECUTION]: Dynamically generates and executes Typst code by writing presentation source files to the local file system and invoking the
typst compilecommand to generate the final PDF output.
Audit Metadata