paper-pdf2zh-notion-import
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands, specifically
pdf2zhand several Python scripts. It uses shell variables like$ORIGINAL_PDFand$OUTDIRwithin these commands. If these variables are populated using metadata from external arXiv papers (such as titles) without rigorous sanitization, it could lead to command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which introduces a risk of indirect prompt injection.
- Ingestion points: arXiv PDF files, HTML source, and LaTeX packages.
- Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between paper content and agent instructions during the reconciliation process.
- Capability inventory: The skill possesses capabilities for shell command execution, local file system writing, and Notion page modification.
- Sanitization: There is no evidence of sanitization for paper content or metadata before it is used in file naming, shell command arguments, or Notion block updates.
- [DATA_EXFILTRATION]: The skill utilizes hardcoded absolute file paths pointing to a specific user's directory (
/Users/wangpu/Downloads/). While likely intended for local organization by the author, hardcoding specific user paths reveals local system structure and could be misused if the environment is shared or compromised.
Audit Metadata