paper-to-code
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted research paper content (PDF, text, or URL) and interpolates it directly into system and user prompts without adequate boundary markers or sanitization logic.
- Ingestion points: Found in
SKILL.mdas the$0argument and inreferences/paper-to-code-prompts.mdvia the{paper_content}variable. - Boundary markers: The prompt templates do not include robust delimiters or explicit instructions to ignore potentially malicious embedded instructions within the research papers.
- Capability inventory: The skill has the capability to write multiple files (
main.py,trainer.py, etc.), generate shell scripts (reproduce.sh), create dependency files (requirements.txt), and execute code for debugging. - Sanitization: No sanitization or validation of the input paper content is mentioned in the workflow or prompts.
- [REMOTE_CODE_EXECUTION]: The workflow requires the agent to generate an execution script (
reproduce.sh) and a list of required third-party packages based on the provided research paper. A malicious paper could influence these outputs to include harmful shell commands or malicious dependencies, leading to code execution. - [DYNAMIC_EXECUTION]: The "Stage 4: Debugging" section in
SKILL.mddescribes a process of collecting execution error messages and applying fixes. This implies that the agent is expected to execute the code it generates from the untrusted research paper source to verify its functionality.
Audit Metadata