academic-chapter-writer
Warn
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill triggers a shell command
python .codex/skills/scripts/fetch_evidence_snippet.py "<claim_text>" "<doi>"using content derived from processed source notes. If the<claim_text>or<doi>variables contain shell metacharacters and are not properly sanitized by the underlying execution environment, this could lead to arbitrary command injection. - [PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external 'source notes' and 'chapter briefs' (Indirect Prompt Injection). Maliciously crafted source material could attempt to influence the agent's behavior or manipulate the parameters passed to the evidence-fetching script.
- Ingestion points: Untrusted data enters the agent context through 'source notes' and 'chapter briefs' provided in the input contract (SKILL.md).
- Boundary markers: None are defined in the instructions to separate source material from system instructions.
- Capability inventory: The skill has the capability to execute a Python script and write output to
evidence_grounding_matrix.md(SKILL.md). - Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content of the claims or DOIs before passing them to the script execution command.
Audit Metadata