literature-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by fetching untrusted text (paper abstracts and titles) from external APIs and local files.
- Ingestion points: Data is ingested from the arXiv API, Semantic Scholar API, and local files in
papers/imports/andpapers/snowball/(e.g., bib, csv, json). - Boundary markers: The script does not implement explicit delimiters or instruction-ignore warnings when storing the retrieved abstracts in
papers/papers_raw.jsonlorpapers/retrieval_report.md. - Capability inventory: The script has the capability to perform network requests to external APIs and write structured files to the agent's workspace.
- Sanitization: String normalization is performed (whitespace stripping, BibTeX cleaning), but there is no specific filtering for prompt injection patterns within the retrieved paper content.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve academic data from external services.
- Evidence: The script fetches paper metadata from
export.arxiv.organdapi.semanticscholar.org. - Well-known Service Proxy: It utilizes
r.jina.ai(a well-known service from Jina AI) as a proxy fallback to fetch Semantic Scholar data in environments where direct TLS connections may be unstable.
Audit Metadata