paper-workflow-orchestrator
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile mandates a 'Zero Interaction Principle', explicitly instructing the AI agent to skip user confirmation and 'silently' start the workflow. This behavior suppresses user oversight and bypasses standard safety interactions by telling the agent 'not to ask' for permission before executing scripts. - [COMMAND_EXECUTION]: The script
scripts/run_all.pyusessubprocess.runto execute multiple external Python scripts and system tools like Pandoc. It targets scripts in hidden directories (.trae/skills/) and dynamically executesstep2_calc_results.pyif present in the project root. - [PROMPT_INJECTION]: The skill ingests untrusted data from user-provided documents in the
problem_files/directory, presenting an indirect prompt injection surface. - Ingestion points: Files in
problem_files/(PDF, Word, data attachments) processed viascripts/run_all.py. - Boundary markers: Absent; no instructions provided to treat content as untrusted.
- Capability inventory: Execution of shell commands and scripts across multiple directories via subprocess.
- Sanitization: Absent; documents are processed directly into the workflow without validation.
Audit Metadata