aris-comm-lit-review
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of ingesting untrusted data from academic databases and local files for summarization and analysis.
- Ingestion points: The workflow in
SKILL.mdspecifies reading external web content fromieeexplore.ieee.org,sciencedirect.com, anddl.acm.org, as well as potentially untrusted local data fromZotero,Obsidiannotes, and localpapers/folders. - Boundary markers: Absent. There are no instructions or delimiters provided to the agent to distinguish between its primary task and any malicious instructions that might be embedded in the retrieved text from papers or user-synced notes.
- Capability inventory: The frontmatter allows the use of powerful tools including
Bash(*),Write, andAgent, which could be exploited if a document contains a malicious injection that influences the agent's behavior. - Sanitization: Absent. Content is processed directly for fact extraction and synthesis without filtering or validation for potential commands or guideline overrides.
Audit Metadata