math-modeling
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto call external tools such aspandoc,xelatex,latexmk, andsoffice(LibreOffice) for document conversion and compilation. These operations are essential to the skill's functionality. Command construction uses argument lists rather than shell strings, which effectively prevents shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: As the skill processes user-provided documents (e.g., contest questions and datasets), it has a potential surface for indirect prompt injection. To mitigate this, the skill implements a structured 'Quality Inspection' workflow. It provides explicit system instructions for subagents, defining them as read-only inspectors and establishing clear boundaries for their role.
- [EXTERNAL_DOWNLOADS]: The skill performs academic searches by querying the OpenAlex and AnySearch APIs. These are established, legitimate services used for retrieving scholarly metadata and abstracts. No evidence of unauthorized data exfiltration or execution of remote untrusted scripts was found.
Audit Metadata