citation-audit
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs provided in bibliography files and from web search results to verify research claims. This ingestion surface is vulnerable to indirect prompt injection, where an attacker could embed malicious instructions in a research paper or webpage that the agent fetches.\n
- Ingestion points: Manuscript .tex files, .bib files, and content fetched from arbitrary external URLs (e.g., howpublished fields) or web searches.\n
- Boundary markers: No explicit instruction delimiters or warnings to ignore embedded instructions are defined for the fetched content.\n
- Capability inventory: The skill uses WebFetch and WebSearch to retrieve data, reads local project files, and has the capability to write modifications back to .bib and .tex files in fix mode.\n
- Sanitization: There is no evidence of sanitization or validation of the fetched text before it is analyzed for claim verification.\n- [DATA_EXFILTRATION]: The skill performs network operations to fetch content from arbitrary URLs specified in the user's bibliography files. It fetches metadata from arXiv (a well-known service) and other web resources to verify their existence and accuracy. These requests to non-whitelisted domains are a functional requirement but are noted as a potential vector for data exposure if the agent is misled by malicious input data.
Audit Metadata