paper-reading
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process text from untrusted external sources, which constitutes a surface for indirect prompt injection attacks. \n
- Ingestion points: The workflow in
SKILL.mdexplicitly includes downloading PDFs from arXiv, searching Semantic Scholar, and retrieving items from a Zotero library. \n - Boundary markers: There are no instructions provided to the agent to use delimiters (like triple backticks or XML tags) or to ignore instructions embedded within the paper text, increasing the risk of the agent following malicious commands found in a document. \n
- Capability inventory: The skill utilizes capabilities to download files, perform web searches, and write data to a local dashboard and the Zotero database (as noted in the 'Step 1' and 'Step 3' workflow sections). \n
- Sanitization: The instructions do not mention any validation, filtering, or sanitization of the content extracted from the external papers. \n- [EXTERNAL_DOWNLOADS]: The skill is configured to download academic content from external sources. \n
- Evidence: The 'Workflow' section in
SKILL.mddetails fetching PDFs from arXiv links and searching Semantic Scholar to obtain paper links for download. These are well-known academic services.
Audit Metadata