verify-citation
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script performs network requests to api.crossref.org and api.openalex.org. These are well-known academic metadata services used to verify citation existence and retrieve abstracts.
- [COMMAND_EXECUTION]: The skill requires executing a Python script (verify_citation.py) which performs file system operations, including reading BibTeX files and reading/writing CSV summary tables.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local files that is then presented to the agent context.
- Ingestion points: The script reads content from local BibTeX files (.bib) and retrieves article titles and abstracts from public APIs (CrossRef and OpenAlex).
- Boundary markers: No explicit delimiters or instructions are used to separate the retrieved abstract text from the agent's instructions.
- Capability inventory: The script has capabilities to read/write local files and perform network GET requests.
- Sanitization: The script performs normalization for metadata comparison (lowercase, removing special characters) but passes raw abstract text (up to 1500 characters) directly to the agent's context without sanitization.
Audit Metadata