figshare-skill

The script is a straightforward Figshare bulk downloader with no evident malicious behavior. It has a medium security concern because API-controlled filenames are appended directly to the output directory, enabling path traversal or absolute-path file overwrites if metadata is malicious or compromised. Remote URLs are also trusted and redirected downloads are saved without integrity checks. Sanitizing filenames with basename and rejecting absolute or escaping paths, constraining URLs, and optionally verifying expected checksums would reduce the risk.