paper-banana

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the paperbanana[mcp] package via pip and its execution via uvx. These resources are fetched from the public PyPI registry.
  • [COMMAND_EXECUTION]: The skill's functionality is delivered through a command-line tool (paperbanana). The agent is instructed to execute various subcommands such as generate, plot, evaluate, and batch to perform figure creation and assessment.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted external data, including research paper PDFs, methodology text files, and CSV datasets. This data is interpolated into prompts for a multi-agent pipeline, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the documents could attempt to influence agent behavior.
  • [DYNAMIC_EXECUTION]: The plot command generates visualization code (specifically Matplotlib) based on input data and intent descriptions. This code is then executed to produce the requested statistical charts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:42 AM