academic-chapter-writer
Fail
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script via the command line:
python .codex/skills/scripts/fetch_evidence_snippet.py "<claim_text>" "<doi>". - [COMMAND_EXECUTION]: The arguments
<claim_text>and<doi>are populated from user-provided source notes and drafted claims. The use of simple double quotes for interpolation is insufficient to prevent command injection; an attacker can execute arbitrary commands by including shell metacharacters such as backticks or semicolons in the input. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface where untrusted data influences privileged capabilities. 1. Ingestion points: User-provided source notes and referenced source material. 2. Boundary markers: Absent; there are no instructions to ignore embedded commands or markers to delimit external content. 3. Capability inventory: Subprocess execution of local scripts and writing results to
evidence_grounding_matrix.md. 4. Sanitization: Absent; there is no requirement or logic provided to escape, validate, or sanitize the content before it is passed to the shell environment.
Recommendations
- AI detected serious security threats
Audit Metadata