paper-formal-writer

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/check_paper_format.py to execute soffice (LibreOffice) for converting Word documents to PDF for quality assurance. This depends on local system tools and does not involve remote code.
  • [DYNAMIC_EXECUTION]: The script scripts/check_paper_format.py uses __import__('os') to dynamically access environment variables, which is a common but indirect method for accessing system configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes and audits manuscript drafts. Validation scripts like scripts/validate_authoring.py scan for internal markers and placeholders, effectively sanitizing the output of content generation steps.
  • [SAFE]: The skill implements robust security controls in scripts/authoring_contracts.py, including SHA-256 file hashing for state validation and a safe_relative_path utility that prevents directory traversal by validating all file paths against the project root.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 02:58 PM