academic-research
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill documentation contains a hardcoded absolute file path (
/Users/alice/worlds/l/mcp_servers.json) in its instructional body, which leaks local system environment information and user account names. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and process content from external, third-party academic sources such as arXiv and PubMed. It lacks explicit boundary markers or instructions for the agent to sanitize or ignore potentially malicious instructions embedded in the fetched papers, creating a vulnerability surface.
- Ingestion points: External academic search APIs (arXiv, PubMed, Semantic Scholar, bioRxiv, medRxiv, Google Scholar) and local database (
bib.duckdb). - Boundary markers: Absent; the instructions do not provide delimiters or warnings to help the agent distinguish between data and instructions in external content.
- Capability inventory: Search tools, citation retrieval, PDF access, and database queries.
- Sanitization: Absent; no evidence of input validation or output escaping for data retrieved from remote repositories.
Audit Metadata