literature-search
Fail
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a high-risk pattern for executing local scripts. It directs the AI agent to run
nodecommands where user-supplied queries are passed as positional arguments without proper escaping or sanitization.\n - Evidence: In
SKILL.md, the instructions includenode scripts/search/semantic-scholar.mjs \"query\" -n 20andnode scripts/search/arxiv.mjs \"query\" -n 15. This allows a malicious user to escape the intended command context by including shell metacharacters in their query.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it aggregates content from various third-party academic sources and web engines.\n - Ingestion points:
SKILL.mddefines a workflow that fetches metadata, abstracts, and synthesis from Semantic Scholar, arXiv, Tavily, and Exa.\n - Boundary markers: None. There are no instructions to the agent to treat search results as untrusted data or to use delimiters to prevent instructions within the abstracts from influencing agent behavior.\n
- Capability inventory: The skill has the ability to execute shell commands (
nodescripts) and perform web searches.\n - Sanitization: No sanitization or validation steps are defined for the incoming search data.
Recommendations
- AI detected serious security threats
Audit Metadata