update-study
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external experiment logs and study markdown files, which provides a potential vector for instructions to be embedded in data processed by the internal interpreter and verifier subagents.
- Ingestion points: Log files (*.log, *.csv) and study markdown files (study.md) read during Phase 0 and Phase 2.
- Boundary markers: Subagent prompts in Phase 4 use markdown section headers as delimiters, but lack explicit instructions to the model to ignore potential commands within the log data.
- Capability inventory: The skill can write files to the local directory (study.md, figures/) and execute system commands for PDF export.
- Sanitization: Relies on subagent-based verification loops rather than deterministic input sanitization.
- [COMMAND_EXECUTION]: The skill uses utility scripts to invoke external document conversion tools, which involves passing file paths derived from user arguments to system binaries.
- Evidence: scripts/export_latex_pdf.py and scripts/export_pdf.py utilize subprocess.run() to call binaries such as pandoc, xelatex, and grip. These calls are made using argument lists, which follows best practices for subprocess execution, but still represents a necessary command execution surface for the skill's functionality.
Audit Metadata