pdf-download
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches external content and executable binaries as part of its core functionality.
- It downloads academic PDF files from remote URLs identified through the research metadata resolution process.
- It automates the installation of the Chromium browser binary using the
playwright installcommand via theuvpackage manager. - [DATA_EXFILTRATION]: To enable access to paywalled papers, the browser-based download logic utilizes a persistent profile that sends existing session cookies to academic publisher websites and DOI resolvers.
- [CREDENTIALS_UNSAFE]: The skill manages a persistent browser profile in
~/.cache/asta/pdf-download-profile/. This directory stores sensitive session materials, including cookies and site data, to maintain authentication state across multiple runs. - [COMMAND_EXECUTION]: The
assets/download-pdfs.pyscript invokes theastaCLI tool to resolve paper identifiers and perform title searches, passing user-provided strings as command arguments.
Audit Metadata