tailor-to-venue
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
venue_diff.py,page_budget.py,anon_sweep.py) to analyze LaTeX files. These scripts are self-contained and use only the Python standard library. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch live data from Call for Papers (CFP) URLs to verify requirements. This is a legitimate functional requirement for ensuring the accuracy of page limits and deadlines.
- [PROMPT_INJECTION]: The skill processes untrusted input from LaTeX source files and external CFP websites. While this represents a surface for indirect prompt injection, it is handled as a standard data processing task without identified malicious patterns.
- [SAFE]: No obfuscation, hardcoded credentials, or persistence mechanisms were detected. The scripts include safety measures such as recursion depth limits in the LaTeX parser and a restricted custom YAML loader for venue profiles.
Audit Metadata