manuscript-review
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of academic manuscripts in PDF, DOCX, LaTeX, or Markdown formats (Workflow Step 1). This creates a surface where an attacker could embed malicious instructions within a manuscript to manipulate the agent's behavior.
- Ingestion points: Workflow Step 1 explicitly handles uploaded manuscripts in multiple formats.
- Boundary markers: No specific delimiters or instructions to ignore embedded prompts are provided in the workflow.
- Capability inventory: The skill involves reading local files and writing a report to the file system (Step 6).
- Sanitization: No sanitization or validation of the input text is described in the provided skill files.
- [DYNAMIC_EXECUTION]: Pass 12 of the workflow instructs the agent to 'compile' LaTeX source if a PDF is not provided. Executing a LaTeX compiler on untrusted user input is a security risk as LaTeX features (such as shell-escape) can be exploited to execute arbitrary commands or access the file system if the environment is not adequately restricted.
Audit Metadata