paper-memory-builder
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted user content, including manuscript drafts (Word, LaTeX, Markdown) and research artifacts (CSV, JSON, Python scripts, logs). This data is often attacker-controlled or contains third-party content, providing a vector for instructions intended to manipulate the agent's behavior during the extraction process.
- Ingestion points: Reads manuscript files (
manuscript.docx,.tex,.md) and various output/log files (.csv,.parquet,.json) from the repository. - Boundary markers: The skill uses YAML structures (
claims.yml,figures.yml) to compartmentalize extracted data, though it relies on the agent to correctly identify and copy text without executing embedded commands. - Capability inventory: The skill writes to the local filesystem and is instructed to run a Python validation script.
- Sanitization: No explicit sanitization or escaping of the manuscript content is described beyond verbatim copying.
- [COMMAND_EXECUTION]: The instructions specify running a local Python script (
scripts/check_claims_schema.py) to validate the generated YAML files. While this script is not provided in the bundle and is likely a repository-local tool, it represents a pattern of command-line execution based on instructions within the skill.
Audit Metadata