alterlab-openalex
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a standard API wrapper for academic research. Analysis of all scripts and documentation confirms that the code performs only the actions described in the documentation.
- [EXTERNAL_DOWNLOADS]: Fetches scholarly data from the OpenAlex API at
api.openalex.org. This is a well-known, open-access repository for scholarly works and bibliometric data. The communication is performed using standard HTTPS requests. - [COMMAND_EXECUTION]: Recommends standard installation of the
requestslibrary viauv pip. This is a routine operation for managing Python dependencies and does not involve elevated privileges. - [PROMPT_INJECTION]: The skill retrieves external text data such as paper abstracts, titles, and author names which constitutes an indirect prompt injection surface.
- Ingestion points: Data enters the system through
OpenAlexClient._make_requestinscripts/openalex_client.pyand is processed by various functions inscripts/query_helpers.py. - Boundary markers: No explicit boundary markers or delimiters are used in the provided code snippets when presenting this data to the agent.
- Capability inventory: The skill is limited to making network GET requests to the OpenAlex API. It does not utilize any subprocess execution, file system modifications, or credential access.
- Sanitization: The scripts do not perform explicit sanitization of the JSON response fields before they are returned. However, the lack of dangerous capabilities mitigates the risk of exploitation.
Audit Metadata