qinyan-paper-analysis
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the remote endpoint https://api.qinyanai.com/v1/paper-search/analyze to perform paper analysis. This is a legitimate functional requirement for the skill's stated purpose.- [COMMAND_EXECUTION]: The skill executes a bash script scripts/analyze.sh which utilizes standard system utilities including curl for API interaction and python3 for verifying the integrity and format of JSON payloads.- [PROMPT_INJECTION]: The skill processes external content (such as paper abstracts or content from URLs) which presents a surface for indirect prompt injection.
- Ingestion points: Paper abstracts, titles, and external URLs provided as input to the analysis script (scripts/analyze.sh).
- Boundary markers: Absent; the skill relies on the structured nature of the JSON payload.
- Capability inventory: Subprocess execution of curl and python3 within the scripts/analyze.sh file.
- Sanitization: The script performs JSON validation using python3 before any network operation is initiated.
Audit Metadata