arxiv
Fail
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches academic paper metadata, abstracts, and citation data from well-known repositories including
export.arxiv.organdapi.semanticscholar.org.- [COMMAND_EXECUTION]: Utilizescurlto fetch API data andpython3to parse XML and JSON responses. Inline Python scripts are used for data transformation. A local helper script (scripts/search_arxiv.py) is also used for searching and formatting results. The tooldefuddleis executed vianpxto extract content from web pages and PDFs.- [DATA_EXFILTRATION]: Conducts network operations to retrieve paper data. These operations are directed at legitimate academic research APIs and do not involve sensitive user credentials or private file access.- [PROMPT_INJECTION]: - Ingestion points: Paper metadata (titles, authors, abstracts) and full text are ingested from external web sources (ArXiv and Semantic Scholar) into the agent context.
- Boundary markers: The skill does not employ specific delimiters or instructions to the agent to disregard potential instructions embedded within the downloaded paper content.
- Capability inventory: The agent has access to network utilities (curl) and local shell execution (python), which could be leveraged if a malicious paper summary were to successfully influence agent behavior.
- Sanitization: Metadata parsing focuses on extraction and display; it does not include sanitization or filtering to prevent the agent from obeying instructions found in research papers.
Recommendations
- HIGH: Downloads and executes remote code from: https://export.arxiv.org/api/query?id_list=1706.03762, https://export.arxiv.org/api/query?search_query=all:GRPO+reinforcement+learning&max_results=5&sortBy=submittedDate&sortOrder=descending, https://api.semanticscholar.org/graph/v1/paper/arXiv:2402.03300?fields=title,authors,citationCount,referenceCount,influentialCitationCount,year,abstract - DO NOT USE without thorough review
Audit Metadata