phd-literature-review
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external academic search results and user inputs, creating an indirect prompt injection surface. * Ingestion Points: User-provided core research assets in P0 and academic literature retrieved via WebSearch in P2. * Capability Inventory: The skill can perform network operations (WebSearch), write local files, and execute shell commands (P8). * Boundary Markers: There are no explicit delimiters or protective instructions (e.g., 'ignore embedded commands') provided when processing search results or user input. * Sanitization: No sanitization is performed on the ingested content before it is used in the writing workflow.
- [COMMAND_EXECUTION]: The skill executes a local Python utility script to transform research findings into a formatted Word document. * Evidence: In P8, the agent is instructed to run
python3 [skill_base_dir]/scripts/generate_docx.pywith arguments for input/output paths. * The process includes writing a temporary markdown file to/tmp/phd_lit_review_temp.mdand saving the final .docx to the user's desktop environment.
Audit Metadata