alterlab-openalex

Pass

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a standard API wrapper for academic research. Analysis of all scripts and documentation confirms that the code performs only the actions described in the documentation.
  • [EXTERNAL_DOWNLOADS]: Fetches scholarly data from the OpenAlex API at api.openalex.org. This is a well-known, open-access repository for scholarly works and bibliometric data. The communication is performed using standard HTTPS requests.
  • [COMMAND_EXECUTION]: Recommends standard installation of the requests library via uv pip. This is a routine operation for managing Python dependencies and does not involve elevated privileges.
  • [PROMPT_INJECTION]: The skill retrieves external text data such as paper abstracts, titles, and author names which constitutes an indirect prompt injection surface.
  • Ingestion points: Data enters the system through OpenAlexClient._make_request in scripts/openalex_client.py and is processed by various functions in scripts/query_helpers.py.
  • Boundary markers: No explicit boundary markers or delimiters are used in the provided code snippets when presenting this data to the agent.
  • Capability inventory: The skill is limited to making network GET requests to the OpenAlex API. It does not utilize any subprocess execution, file system modifications, or credential access.
  • Sanitization: The scripts do not perform explicit sanitization of the JSON response fields before they are returned. However, the lack of dangerous capabilities mitigates the risk of exploitation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 12, 2026, 12:46 AM
Security Audit — agent-trust-hub — alterlab-openalex