pre-submission-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external documents (technical papers). It lacks instructions for the agent to use boundary markers or delimiters when handling this content, which could allow instructions embedded within a paper to influence or override the agent's behavior.\n
- Ingestion points: The paper content or specific sections provided by the user, as described in the 'Overview' and 'Step 1' of the core procedure in SKILL.md.\n
- Boundary markers: The skill does not instruct the agent to use delimiters (e.g., XML tags or triple quotes) to separate the untrusted paper text from the review instructions.\n
- Capability inventory: The agent is instructed in 'Step 1' to use scholarly tools, web search, or shell access to public APIs for novelty verification and citation checks.\n
- Sanitization: There are no instructions to sanitize or validate keywords extracted from the document before they are used in external search or retrieval operations.\n- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to use 'shell access to public APIs' if available in the environment to verify novelty and citations. While it does not contain malicious code, the instruction to extract keywords from untrusted user content and pass them to shell-based tools creates a potential command injection surface if the agent does not properly escape the input.\n
- Evidence: SKILL.md Step 1: 'retrieval-grounded checks (when the environment has... shell access to public APIs)'.
Audit Metadata