compiler
Warn
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution using the agent's tools to manage repositories, organize directories, and execute Python logic as part of the data extraction workflow.
- [EXTERNAL_DOWNLOADS]: The workflow involves downloading content from external repositories via version control tools, which introduces the risk of ingesting unverified third-party assets.
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to generate and run Python code (utilizing libraries like PyMuPDF) to extract visual data from PDF documents. Running dynamically created scripts on untrusted input files constitutes a security risk.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes external research data (PDFs and code) that could contain malicious instructions designed to exploit the agent's capabilities.
- Ingestion points: Untrusted data from research papers and remote repositories enters the agent's context during the 'Read Inputs' stage (defined in SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or boundary markers to separate external data from the agent's operational logic.
- Capability inventory: The agent possesses capabilities for file modification, information retrieval, and shell command execution (defined in the SKILL.md frontmatter).
- Sanitization: The workflow does not require sanitizing or validating input data extracted from research sources before processing it.
Audit Metadata