arxiv-to-md
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Prompt Injection (HIGH): The instruction "Do NOT explore or analyze first. Run the script and follow its output" is a direct attempt to override the AI agent's internal reasoning, safety checks, and standard 'analyze before act' behavior.
- Indirect Prompt Injection (HIGH):
- Ingestion points: The skill ingests untrusted external data from arXiv IDs, URLs, and local PDF folders.
- Capability inventory: The skill executes a Python script (
skills.arxiv_to_md.main) that likely parses TeX/PDF data and produces content for the agent to process. - Boundary markers: There are no markers or delimiters defined to separate the untrusted external paper content from the agent's instructions.
- Sanitization: No sanitization or filtering of the external content is mentioned, allowing malicious instructions embedded in papers to influence the agent.
- Command Execution (MEDIUM): The skill uses
python3 -mto execute local code. While the script is internal to the skill package, the combination with a bypass instruction makes this execution high-risk as the script's behavior is intentionally shielded from analysis.
Recommendations
- AI detected serious security threats
Audit Metadata