chat-with-arxiv
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from external ArXiv papers that are not under the user's direct control.
- Ingestion points: Research paper PDF content and metadata are fetched via the ArXiv API and downloaded in 'examples/paper_content_processor.py'.
- Boundary markers: The LLM prompt in 'examples/paper_question_answerer.py' interpolates chunked paper text without specific delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill performs network requests for PDF downloads and uses the 'PyPDF2' library to extract text which is then processed by an LLM.
- Sanitization: There is no evidence of sanitization or instruction-filtering for the extracted PDF text before it is presented to the LLM.
- [EXTERNAL_DOWNLOADS]: The skill downloads research papers from the official ArXiv repository.
- Evidence: 'PaperContentProcessor.download_pdf' in 'examples/paper_content_processor.py' uses the 'requests' library to fetch content from ArXiv URLs. This targets ArXiv, which is a well-known service for scientific research literature.
Audit Metadata