auto-paper-improvement-loop
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and processes external, untrusted LaTeX source files from the paper directory. An attacker could embed malicious instructions within these files that might influence the agent's behavior when it implements suggested fixes.
- Ingestion points: The skill concatenates all .tex files in paper/sections/ to create a review prompt for an external LLM (Step 1).
- Boundary markers: The skill uses simple LaTeX comments as separators between files, which are insufficient to prevent an LLM from following instructions embedded in the source text.
- Capability inventory: The skill utilizes powerful tools (Write, Edit, Bash) to modify the local filesystem based on output generated from the processed content.
- Sanitization: No sanitization or filtering of the input LaTeX files is performed before they are sent for review.
- [DATA_EXFILTRATION]: The skill attempts to read a configuration file from the user's home directory (~/.claude/feishu.json) to send review summaries to the Feishu platform. While documented as a notification feature for a well-known service, accessing local configuration data and transmitting it to an external endpoint constitutes a data exfiltration surface.
Audit Metadata