pdf-download

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches external content and executable binaries as part of its core functionality.
  • It downloads academic PDF files from remote URLs identified through the research metadata resolution process.
  • It automates the installation of the Chromium browser binary using the playwright install command via the uv package manager.
  • [DATA_EXFILTRATION]: To enable access to paywalled papers, the browser-based download logic utilizes a persistent profile that sends existing session cookies to academic publisher websites and DOI resolvers.
  • [CREDENTIALS_UNSAFE]: The skill manages a persistent browser profile in ~/.cache/asta/pdf-download-profile/. This directory stores sensitive session materials, including cookies and site data, to maintain authentication state across multiple runs.
  • [COMMAND_EXECUTION]: The assets/download-pdfs.py script invokes the asta CLI tool to resolve paper identifiers and perform title searches, passing user-provided strings as command arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 08:02 AM
Security Audit — agent-trust-hub — pdf-download