Skills
skills/yipng05-max/-skills/literature-review-writer/Gen Agent Trust Hub

literature-review-writer

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands to create a temporary markdown file in /tmp/ and subsequently run a local Python script (scripts/generate_docx.py) to convert it into a Word document. This involves writing directly to the user's ~/Desktop/ folder.
  • [EXTERNAL_DOWNLOADS]: The scripts/generate_docx.py file requires the python-docx library, which is an external dependency.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from web search results (SKILL.md). Boundary markers include the verification workflow in Step 3 and the verification-guide.md reference. Capabilities include file system writes via scripts/generate_docx.py. Sanitization is attempted via the literature-verifier skill and manual verification guides. This represents an indirect prompt injection surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 03:30 PM