hugging-face-paper-publisher
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
huggingface.coandarxiv.org. These are well-known and trusted services used for their intended purposes (indexing papers and fetching research metadata). - [DATA_EXFILTRATION]: The skill uses
HF_TOKENto interact with the Hugging Face Hub. It follows best practices by loading credentials from environment variables viapython-dotenvor retrieving them from the standard Hugging Face configuration folder. No unauthorized exfiltration of sensitive data was detected. - [COMMAND_EXECUTION]: While the skill instructions mention executing Python scripts from the command line, the scripts themselves do not contain any arbitrary command execution, subprocess spawning with untrusted input, or shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from arXiv (titles, abstracts) and repository README files. While this is an ingestion point for untrusted data, the skill only performs structured text replacement for documentation purposes, presenting a negligible risk of influencing agent behavior in a malicious way.
Audit Metadata