skills/eugenepyvovarov/mcpbundler-agent-skills-marketplace/hugging-face-paper-publisher/Gen Agent Trust Hub
hugging-face-paper-publisher
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform file operations, such as creating research article files from templates and modifying README files. These operations are essential to the skill's functionality and do not involve unauthorized command execution.- [EXTERNAL_DOWNLOADS]: The script fetches paper metadata from the arXiv API and interacts with the Hugging Face Hub API to manage repository content. These are recognized, well-known services for scientific research, and the interactions are transparent and consistent with the skill's purpose.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to processing data from external sources.\n
- Ingestion points: Data is ingested from arXiv (paper titles, abstracts) and Hugging Face repositories (README.md files).\n
- Boundary markers: There are no explicit delimiters used to separate ingested external data from instructions provided to the agent.\n
- Capability inventory: The skill has the ability to write files locally and update files on the Hugging Face Hub.\n
- Sanitization: Ingested data is processed using regular expressions for formatting but is not sanitized specifically to prevent adversarial instructions from influencing the agent's behavior.
Audit Metadata