paper-readability-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'NanumGothic' font from Google's official GitHub repository if it is not found on the local system. This reference to a trusted source is documented neutrally.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
python3 -cfor extracting text from PDFs and rendering pages into PNG images during its review loop. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF data ('PAPER.pdf') and lacks explicit boundary markers or sanitization for the extracted text. It possesses capabilities including shell command execution, file writing, and network access (font download), creating a surface for indirect prompt injection.
- [DYNAMIC_EXECUTION]: The workflow involves generating and executing short Python script snippets through the command line to automate PDF processing and rendering tasks.
Audit Metadata