paper-write-sci
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user-provided data, such as LaTeX source files and Figure/Table notes, which are then used to generate or revise scientific paper content.
- Ingestion points: LaTeX files within the provided paper directory (
paper_dir), Figure/Table notes (notes.md), and reference author materials (reference_material). - Boundary markers: The instructions do not explicitly define boundary markers or delimiters when interpolating untrusted content into prompts, nor do they include specific warnings to the model to ignore instructions embedded within the paper drafts.
- Capability inventory: The skill possesses extensive capabilities, including reading and writing to the local file system and executing shell commands (e.g.,
latexmk,xelatex,make,python3,gh). - Sanitization: There is no documented logic for sanitizing or escaping external content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands to perform its core functions, such as rendering LaTeX documents into PDF/Word and reporting bugs via the GitHub CLI (
gh). While these operations are scoped to the project environment and the author's own bug repository, they represent an execution surface that could be exploited if malicious instructions are successfully injected into the agent's context.
Audit Metadata