arxiv-prep
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
uvxto download and executearxiv-latex-cleanerandbib_optimizerfrom the Python Package Index (PyPI).arxiv-latex-cleaneris a recognized tool maintained by the Google Research organization. - [COMMAND_EXECUTION]: The skill executes several shell commands to process files locally. This includes
pdflatexfor document compilation,tarfor creating submission packages, andbibtoolfor bibliography management. These are standard utilities for LaTeX document preparation. - [DATA_EXFILTRATION]: No network exfiltration patterns were detected. All file operations (cleaning, merging, and packaging) are performed on a local copy (
_arXiv/directory) of the user's paper. The skill only provides a URL to the official arXiv submission site for the user to manually upload the final package. - [PROMPT_INJECTION]: The skill extracts metadata such as titles and abstracts from user-provided LaTeX files. While this involves ingesting untrusted data, the processing is limited to extracting specific fields for display to the user, presenting a minimal surface for indirect prompt injection.
Audit Metadata