select-venue
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves data from the DBLP academic repository and conference websites to provide venue information.
- Evidence: The script
scripts/dblp_venue_lookup.pyperforms HTTP GET requests todblp.org. This is a well-known service for computer science researchers, and the script implements polite access patterns (rate limiting and caching). - [PROMPT_INJECTION]: The skill processes untrusted data from external sources, presenting a standard surface for indirect prompt injection.
- Ingestion points: Data is ingested from live Call For Papers (CFP) URLs and DBLP API search results.
- Boundary markers: No explicit boundary markers or delimiters are instructed in the prompt to isolate external content.
- Capability inventory: The agent can execute provided local Python scripts (
list_venues.py,dblp_venue_lookup.py) and is instructed to interact with theverify-citationsskill. - Sanitization: No specific sanitization or filtering of external text is described.
- Context: The risk is minimal as the skill instructions explicitly direct the agent to ground its output in verified profile data and live CFPs, and include 'Guardrails' to prevent fabrication of ranking signals.
Audit Metadata