iterate-revision
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from manuscript files and outputs from writer/reviewer subagents, interpolating them into instructions for further agent actions. This creates a surface for indirect prompt injection where malicious content in a processed file could override agent behavior.
- Ingestion points: Manuscript section files (.tex, .md, .txt), paper.json fields (hypothesis, title), and the generated outputs from the @paper-writer and @reviewer subagents.
- Boundary markers: The skill uses simple textual labels like 'Current section content:' to separate data from instructions but lacks robust delimiters or explicit instructions to the agent to treat interpolated content as untrusted data.
- Capability inventory: The skill is configured to write to and edit specified project files and dispatch subagents through orchestration primitives.
- Sanitization: While structured output from the reviewer is validated against a schema, the writer's prose and the initial manuscript content are handled as raw strings and interpolated into prompts without escaping or sanitization.
Audit Metadata