citation-integrity-reviewer
Warn
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The agent is directed to execute a local Python script using a JSON object derived from user-provided content. Evidence: 'Programmatically validate all DOIs... by executing python .codex/skills/scripts/validate_references.py "<doi_list_json>"' in SKILL.md. This pattern of passing AI-extracted strings directly into shell commands is vulnerable to injection attacks if the agent extracts malicious payload characters from the user's draft into the JSON argument.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted drafts and bibliographies while maintaining script execution capabilities. Ingestion points: 'draft text' and 'source list' in SKILL.md. Boundary markers: Absent. Capability inventory: Command execution via Python. Sanitization: Absent. The skill lacks instructions to sanitize draft content or protect the execution environment from instructions embedded in the processed text.
Audit Metadata