arxiv
Fail
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted content (titles, abstracts, and author names) from external academic APIs. This text is then used as context for the agent, which could theoretically contain malicious instructions designed to influence the agent's research conclusions or subsequent tool usage. Severity: LOW.
- [COMMAND_EXECUTION]: The instructions frequently use shell pipes (e.g.,
curl | python3) to process API data. Automated scanners flagged these as potential remote code execution; however, manual review confirms that thepython3commands either use the-m json.toolmodule for formatting or execute hardcoded parsing logic provided directly within the skill's instructions. These commands process remote data as input rather than executing it as code. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
export.arxiv.organdapi.semanticscholar.org. Both are well-known, reputable academic services. Per security guidelines, these are considered safe external sources and do not contribute to a higher severity verdict.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.semanticscholar.org/graph/v1/paper/arXiv:2402.03300?fields=title,authors,citationCount,referenceCount,influentialCitationCount,year,abstract, https://export.arxiv.org/api/query?id_list=1706.03762, https://export.arxiv.org/api/query?search_query=all:GRPO+reinforcement+learning&max_results=5&sortBy=submittedDate&sortOrder=descending - DO NOT USE without thorough review
Audit Metadata