paper-review
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python packages, including py-openjudge, litellm, and pypdfium2. py-openjudge is a core dependency associated with the skill's functionality, while litellm and pypdfium2 are well-known libraries for LLM integration and PDF processing.
- [COMMAND_EXECUTION]: The skill operates by executing the cookbooks.paper_review Python module as a command-line tool. It provides multiple usage examples involving shell command execution with various flags for paper analysis.
- [PROMPT_INJECTION]: The Troubleshooting section in SKILL.md contains strong instructional directives marked as 'CRITICAL' and 'MUST'. These instructions attempt to override the agent's default behavior by prohibiting manual fallback actions when the tool pipeline fails.
- [PROMPT_INJECTION]: The skill processes untrusted document formats (PDF, TeX packages, and BibTeX files), which presents a surface for indirect prompt injection attacks. 1. Ingestion points: User-supplied files provided via the positional input argument and the --bib flag. 2. Boundary markers: The documentation explicitly mentions a 'Safety check' stage for jailbreak detection and format validation. 3. Capability inventory: The pipeline performs network operations via litellm to LLM providers and connects to academic databases like CrossRef, arXiv, and DBLP for reference verification; it also generates local markdown reports. 4. Sanitization: The skill incorporates automated safety checks including jailbreak detection to mitigate risks from malicious content within papers.
Audit Metadata