aris-paper-figure
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Bash loop in Step 5 to run dynamically generated Python scripts (
python "$script"). This is a core part of the workflow but presents a surface for executing unintended code if the generation process is compromised.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data to drive its logic without sufficient boundaries. - Ingestion points: The skill reads
PAPER_PLAN.mdand experiment data files (JSON/CSV) to determine figure types, descriptions, and captions. - Boundary markers: No delimiters or safety instructions are defined to prevent the agent from following instructions embedded within these data files.
- Capability inventory: The agent possesses powerful capabilities including
Bash,Write, and themcp__codex__codextool. - Sanitization: There is no evidence of sanitization or validation of the input data before it is used to construct Python scripts or prompts for the external reviewer model.- [DATA_EXFILTRATION]: Local metadata, such as figure descriptions and captions extracted from the user's project, is transmitted to an external service via the
mcp__codex__codextool for quality review in Step 7.
Audit Metadata