tooluniverse-literature-deep-research
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent in SKILL.md to 'write and run Python code via Bash' to perform statistical analysis and data processing on retrieved research data. While the scope is targeted at standard data libraries like pandas and scipy, this represents dynamic code generation and execution at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from over 120 external academic databases and arbitrary web URLs, creating a vulnerability surface where malicious instructions embedded in a research paper could influence the agent's behavior. 1. Ingestion points: Untrusted data enters the agent context through tools referenced in SKILL.md and URL fetching described in FULLTEXT_STRATEGY.md. 2. Boundary markers: Absent; instructions do not provide specific delimiters to separate untrusted literature content from system prompts. 3. Capability inventory: The agent has access to Bash command execution, a Python interpreter, and file system writes for generating reports. 4. Sanitization: Absent; academic text is processed directly for synthesis without sanitization layers.
- [COMMAND_EXECUTION]: The skill utilizes a Bash shell to facilitate the execution of Python code, providing a mechanism for command-line operations based on potentially untrusted input.
- [DATA_EXFILTRATION]: Through the get_webpage_text_from_url utility mentioned in TOOL_NAMES_REFERENCE.md, the skill enables network access to arbitrary external domains, which provides a potential channel for data movement to non-whitelisted servers.
Audit Metadata