publication-chart-skill

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/ensure_publication_tooling.py performs dynamic imports as part of its environment verification process.\n
  • Evidence: The script uses importlib.import_module() to check for the presence of the pubfig and pubtab packages in the Python environment before attempting to use them.\n- [COMMAND_EXECUTION]: The skill uses shell commands for environment management and to perform data conversion tasks.\n
  • Evidence: The helper script scripts/ensure_publication_tooling.py utilizes subprocess.run to execute package managers like pip or uv for installing dependencies.\n
  • Evidence: Skill instructions in SKILL.md direct the agent to execute the pubtab CLI tool to convert Excel spreadsheets into LaTeX tables.\n- [EXTERNAL_DOWNLOADS]: The skill is configured to automatically download and install required Python libraries if they are not available in the local environment.\n
  • Evidence: The SKILL.md workflow and the ensure_publication_tooling.py script are designed to install the pubfig and pubtab packages from public registries to ensure the workflow is runnable.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources which represents a potential attack surface for indirect prompt injection.\n
  • Ingestion points: According to SKILL.md, the skill ingests user-provided research results, Excel workbooks, LaTeX snippets, and raw data files.\n
  • Boundary markers: Absent; there are no specific delimiters or warnings provided to the agent to prevent it from following instructions that might be embedded within the research data.\n
  • Capability inventory: The skill has permissions to write files to the filesystem (e.g., PDF, PNG, SVG outputs) and execute CLI commands via the pubtab tool.\n
  • Sanitization: Absent; the skill relies on the internal parsing logic of the pubfig and pubtab libraries without performing explicit sanitization of the input content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 03:47 AM