peer-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content (academic papers) as its primary input, creating a vulnerability surface.
- Ingestion points: In Phase 2, the full text of the paper is passed directly into the context of multiple independent subagents created via the Task tool.
- Boundary markers: The instructions do not specify the use of delimiters or safety preambles to distinguish the untrusted paper content from the agent's instructions, which may lead to the subagents obeying instructions embedded within the paper.
- Capability inventory: The environment allows the orchestrator and subagents to use high-privilege tools including Bash, WebFetch, Write, and Edit, which could be exploited for data exfiltration or unauthorized system access if an injection is successful.
- Sanitization: There is no evidence of input validation, filtering, or escaping of the paper content before it is processed by the subagents.
Audit Metadata