nsfc-length-aligner
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check_length.pyexecutes the system utilitypdfinfousingsubprocess.runto retrieve page counts from PDF files. This is a standard implementation of a helper tool utilizing safe, list-based argument passing. - [PROMPT_INJECTION]: The skill processes user-provided document content which constitutes an indirect prompt injection surface. (1) Ingestion point: Document files (.tex, .md) are read by
scripts/check_length.py. (2) Boundary markers: The skill relies on natural language instructions and a specific rubric (references/MEANING_PRESERVING_REWRITE_RUBRIC.md) to constrain the AI's behavior when processing document content. (3) Capability inventory: The skill allows the execution of a local Python script and access to system utilities (pdfinfo). (4) Sanitization: The Python script uses regex to strip code-like structures such as LaTeX commands and math environments before the text is presented to the AI for length analysis, reducing the risk of accidental execution of embedded instructions. - [SAFE]: The skill performs its analysis and report generation locally within the user's project directory (defaulting to a
.nsfc-length-alignerfolder). No network operations or external data transmissions were identified.
Audit Metadata