Search SOP
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses local application data, specifically '
/Zotero/zotero.sqlite' and '/Documents/*.enl' files. While this is the intended function for importing research libraries, it involves reading from the local file system. - [EXTERNAL_DOWNLOADS]: The skill fetches data from numerous academic APIs and web endpoints using 'web_fetch'. These targets include well-known academic services such as arXiv, CrossRef, OpenAlex, Europe PMC, and Semantic Scholar.
- [COMMAND_EXECUTION]: The skill utilizes a browser tool to perform RPA (Robotic Process Automation) on academic databases including Google Scholar and CNKI. It provides specific instructions for navigation, interaction, and data extraction.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted data from external sources.
- Ingestion points: Untrusted data enters the agent context through academic API responses, 'web_fetch' content (RSS feeds, HTML, or API endpoints), browser snapshots of external websites, and metadata extracted from local PDF files.
- Boundary markers: Absent. The instructions do not define specific delimiters or warnings to ignore instructions embedded within the research papers or web pages being processed.
- Capability inventory: The skill possesses network access capabilities via 'web_fetch' and 'browser' and has the ability to write to the local library via 'library_add_paper' and 'library_batch_add'.
- Sanitization: The skill includes a verification step where the agent is instructed to validate extracted metadata via 'resolve_doi' or 'search_arxiv' before adding papers to the library, providing a basic layer of data validation.
Audit Metadata