manage-bibliography
Fail
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions to use
sudo apt installto resolve system-level dependencies for R packages, which involves privilege escalation.- [EXTERNAL_DOWNLOADS]: The skill automatically installs R packages (RefManageR, bibtex, stringdist) from CRAN repositories during execution.- [EXTERNAL_DOWNLOADS]: The skill fetches bibliographic metadata from external DOI resolution services (CrossRef) at runtime.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from malicious bibliographic data embedded in external files. - Ingestion points: Bibliographic data is read from files such as
references.bib,project_a.bib, andproject_b.bib. - Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The agent has access to
Bash,Write,Edit, andReadtools. - Sanitization: Field data (titles, authors) from untrusted files is processed and outputted without sanitization or validation.
Recommendations
- AI detected serious security threats
Audit Metadata