alterlab-openalex

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the requests library for HTTP communication. This is a standard, well-known package installed via uv pip from the official PyPI registry, representing a common and safe dependency for Python applications.
  • [DATA_EXFILTRATION]: Network activity is restricted to the official OpenAlex API domain (api.openalex.org). The skill handles sensitive API keys by reading them from the OPENALEX_API_KEY environment variable and transmitting them via the Authorization: Bearer header, which is the recommended practice to prevent credential leakage in logs or URL parameters.
  • [SAFE]: The skill implementation in scripts/openalex_client.py and scripts/query_helpers.py is clean and focused on its stated purpose. It includes robust error handling for API cost budgets (HTTP 429) and correctly implements scholarly search patterns like two-step entity resolution (Name to ID) to ensure data accuracy. No patterns of obfuscation, persistence, or privilege escalation were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 02:36 PM