paper-write
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates bibliography management by fetching BibTeX data from established academic databases. This includes querying the DBLP computer science bibliography (dblp.org) and the CrossRef DOI resolver (doi.org) to ensure citation accuracy and prevent hallucinated metadata. These are well-known services in the research community.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform project maintenance and execute Python-based verification scripts. Specifically, it runs an automated bibliography hygiene audit and a cleanup process to remove stale LaTeX section files when the project structure changes. These operations are essential for maintaining a compilable and accurate LaTeX project.
- [DYNAMIC_EXECUTION]: The workflow incorporates dynamically executed Python logic for complex data processing tasks, such as filtering bibliography files to include only cited entries and performing cross-verification between local metadata and official database records. The scripts are executed as heredocs within Bash commands, a standard pattern for multi-step agent tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface because it processes untrusted research data and external citation metadata.
- Ingestion points: Reads research content from
PAPER_PLAN.md,NARRATIVE_REPORT.md, and retrieves bibliographic records from dblp.org and CrossRef. - Boundary markers: The instructions do not define explicit delimiters when interpolating user-provided narrative content into LaTeX templates.
- Capability inventory: The skill possesses file writing capabilities (
Write), shell execution (Bash), and network access (WebFetch/curl). - Sanitization: While the skill lacks formal input sanitization for the prose content, it implements strict consistency validation for bibliographic data, comparing retrieved years, venues, and author lists against local expectations to detect discrepancies.
Audit Metadata