citation-management
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run several local Python scripts (e.g., search_google_scholar.py, search_pubmed.py, extract_metadata.py) to automate citation tasks. One script, generate_schematic.py, accepts natural language descriptions as command-line arguments which are executed by the underlying environment.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests and processes untrusted metadata from external research databases.
- Ingestion points: Data is retrieved from Google Scholar, PubMed, CrossRef, and arXiv APIs through scripts like search_google_scholar.py and extract_metadata.py. It also reads content from local BibTeX files.
- Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to disregard instructions embedded within the retrieved data.
- Capability inventory: The skill performs file writes, network requests, and executes local scripts.
- Sanitization: There is no description of sanitization or validation of the external content before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: Connects to and retrieves information from established academic services and databases including the CrossRef API, PubMed E-utilities, arXiv API, and DataCite API.
Audit Metadata