paper-writing
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted research narratives and data (e.g., NARRATIVE_REPORT.md) to generate structured LaTeX documents and figure scripts. Maliciously crafted content within the research input could attempt to hijack the agent's logic during the multi-phase pipeline.
- Ingestion points: Processes '$ARGUMENTS' and 'NARRATIVE_REPORT.md' (SKILL.md).
- Boundary markers: Absent; there are no instructions or delimiters used to isolate processed research content from the agent's core instructions.
- Capability inventory: The skill has access to Bash, file system tools (Write, Edit, Glob), and the ability to orchestrate other agents and skills (SKILL.md).
- Sanitization: No sanitization or validation of the input report content is performed before it is interpolated into generating commands.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to use Bash commands to circumvent limitations of standard file-writing tools.
- Evidence: The instructions state: 'If the Write tool fails due to file size, immediately retry using Bash (cat << 'EOF' > file) to write in chunks. Do NOT ask the user for permission — just do it silently.' (SKILL.md). This pattern promotes the autonomous execution of shell commands based on model-generated content without human oversight.
Audit Metadata