paper-poster-html
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fulfill its primary purpose:
- Fetches academic conference poster specifications (dimensions, orientation) from official venue websites.
- Downloads the Chromium browser via Playwright (
python3 -m playwright install chromium) to enable print-emulated PDF generation. - Downloads the MathJax
tex-svg.jslibrary for localized mathematical formula rendering. - [COMMAND_EXECUTION]: Executes various local utility scripts and system tools required for PDF processing and layout validation:
- Invokes
run_gates.py,render_preview.py, andposter_check.pyfrom the skill's own directory. - Uses system tools such as
pdftoppm,inkscape, orpdf2svgfor figure extraction and conversion. - [DATA_EXPOSURE]: Accesses user-provided research papers (LaTeX or PDF) to extract text and figures for poster content. The skill explicitly warns against fabricating data and implements a provenance manifest for all extracted assets.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (academic papers) which presents an indirect injection surface.
- Ingestion points: Research paper source files (.tex, PDF) read in Phase 1 and 2.
- Boundary markers: None explicitly defined in the
spawn_agentprompts; content is passed via file paths. - Capability inventory: The skill has access to
Bash,Write, andEdittools via the primary agent, and can spawn sub-agents for review. - Sanitization: No specific text sanitization is mentioned, but the use of "fresh" reviewer agents (Phase 1 and 6) mitigates cross-context injection risks by resetting session memory.
Audit Metadata