aris-semantic-scholar
Warn
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in SKILL.md specify interpolating user-supplied input ($ARGUMENTS) directly into shell commands (e.g., python3 "$SCRIPT" search "QUERY"). This pattern is vulnerable to command injection if the input contains shell metacharacters like semicolons, backticks, or pipes.
- [COMMAND_EXECUTION]: The skill uses a loose discovery mechanism in SKILL.md (find and head -1) to locate its execution script semantic_scholar_fetch.py. This relies on the integrity of the local file system and could be exploited if a malicious file with the same name is placed in the search paths.
- [PROMPT_INJECTION]: The skill processes academic data from the Semantic Scholar API and presents it to the user, creating an indirect prompt injection surface. * Ingestion points: API response data (titles, TLDRs, abstracts) processed in SKILL.md Steps 5 and 6. * Boundary markers: None identified; data is presented in standard markdown tables and lists. * Capability inventory: Bash(*), Read, and Write tools allowed in frontmatter. * Sanitization: No explicit sanitization or filtering of API content is mentioned before presentation.
Audit Metadata