aris-paper-plan
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to handle file writing operations, specifically using heredocs (cat << 'EOF') to manage content, which involves executing shell commands with project-derived data.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests data from external files like STORY.md and NARRATIVE_REPORT.md without using boundary markers or sanitization.
- Ingestion points: Step 1 reads data from several files including NARRATIVE_REPORT.md, STORY.md, GPT54_AUTO_REVIEW.md, and experiment results in the figures directory.
- Boundary markers: No delimiters or instructions to ignore embedded commands are present when interpolating project data into the workflow.
- Capability inventory: The skill has access to tools including Bash, Write, Edit, and Agent, providing a broad capability set for potential exploitation.
- Sanitization: The skill does not validate or escape the content it reads from the local environment before processing it.
- [EXTERNAL_DOWNLOADS]: The skill references external methodologies and research tools hosted on GitHub, such as Master-cai/Research-Paper-Writing-Skills and Galaxy-Dawn/claude-scholar, which are used as informational resources for the outline generation process.
Audit Metadata