paper-deep-dive
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (PDFs, arXiv HTML, and LaTeX source) from the internet. This data is used as input for translation and analysis workflows. There is a risk that malicious instructions embedded in the analyzed papers could be interpreted by the AI agent to influence its behavior.
- Ingestion points: Processes research papers and supplementary materials sourced from external URLs like arXiv or publisher websites.
- Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used to wrap the untrusted paper content during the repair and translation process.
- Capability inventory: The skill possesses capabilities to execute shell scripts (
mineru-md.sh), manage local files in a downloads directory, and interact with the Notion API. - Sanitization: There are no instructions for sanitizing or validating ingested content for adversarial prompts before it is processed.
- [COMMAND_EXECUTION]: The skill directs the agent to execute a local shell script (
$WORLD_MODEL_VAULT/.tools/mineru-md.sh) and interact with a binary ($WORLD_MODEL_VAULT_MINERU_BIN). Using environment-variable-defined paths for local script execution relies heavily on the security and integrity of the local environment configuration. - [DATA_EXFILTRATION]: The skill contains a hardcoded absolute file path (
/Users/wangpu/Downloads/), which exposes a local system username (wangpu). This constitutes a minor information exposure that reveals local system identity and directory structure.
Audit Metadata