universal-exam-cram-coach
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection (Category 8) because its primary function is to ingest and process untrusted course materials (e.g., student-provided PDFs or documents) to generate tutoring content.
- Ingestion points: User-provided material folders processed via scripts/ingest_course.py and scripts/ingest.py.
- Boundary markers: The skill instructions focus on pedagogical grounding and provenance labeling (🟢/🟡/⚠️) to ensure answer accuracy, but do not specify technical sanitization to prevent the agent from executing instructions hidden within the course materials.
- Capability inventory: The skill makes extensive use of subprocess.run across its utility scripts to manage document parsing and workspace orchestration.
- Sanitization: Content is cleaned and logically chunked in scripts/chunk.py for retrieval, but there is no evidence of security-focused filtering of the processed text.
- [COMMAND_EXECUTION]: The skill uses Python's subprocess module for various legitimate engineering tasks. For example, scripts/ingest_course.py orchestrates the build pipeline, scripts/cheatsheet_render.py invokes headless browsers (msedge or chrome) for PDF generation, and benchmark scripts like benchmark/gen.py drive the Claude CLI for evaluation runs. These commands are parameter-controlled and restricted to the workspace or package directory.
- [EXTERNAL_DOWNLOADS]: The documentation provides installation commands that fetch the skill repository from the author's GitHub account (github.com/ZeKaiNie/universal-examprep-skill). It also recommends installing well-established Python packages such as pymupdf and latex2mathml from the official Python Package Index (PyPI) to support PDF processing and math typesetting.
Audit Metadata