lit-sync
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for legitimate academic research workflows and follows transparent operating procedures defined in its 'Artifact Contract'.
- [COMMAND_EXECUTION]: Employs local Python scripts and standard bash utilities (stat, curl, grep) to verify file updates and service connectivity. The execution is strictly scoped to the user's project workspace and the local Zotero instance.
- [EXTERNAL_DOWNLOADS]: Fetches citation metadata from the official NCBI PubMed API (
eutils.ncbi.nlm.nih.gov), which is a well-known and trusted scientific service. This activity is restricted to metadata retrieval for academic papers. - [DATA_EXFILTRATION]: No sensitive information is exfiltrated to untrusted domains. Network communication is limited to the localhost Better BibTeX server and trusted academic databases.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from BibTeX files and APIs to populate literature notes. It effectively mitigates injection risks by using rigid Markdown templates and explicit 'Anti-Hallucination' rules that prevent the fabrication of data or unauthorized modification of existing notes.
Audit Metadata