skills/brycewang-stanford/auto-empirical-research-skills/literature-review-tools/Gen Agent Trust Hub
literature-review-tools
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/litrun.pylauncher usessubprocess.runto execute commands for creating virtual environments, installing packages, and running the selected tools. This is a core feature of the skill to automate the setup of various research tools. - [EXTERNAL_DOWNLOADS]: The skill downloads and installs Python packages from PyPI (e.g.,
mineru,marker,paper-qa) and clones official repositories from GitHub (e.g.,gpt-researcher,storm) for tools that provide web UIs. These downloads target established open-source projects relevant to the skill's purpose. - [REMOTE_CODE_EXECUTION]: The
scripts/fetch_arxiv.pyscript downloads PDFs from arXiv based on user-provided search queries. This is a standard retrieval task for literature review and does not involve executing remote code locally. - [CREDENTIALS_UNSAFE]: The skill manages API keys (like
OPENAI_API_KEY) by writing them to a shared local.envfile at~/.lit-review-tools/.env. This is a standard practice for local tool development and does not hardcode secrets or exfiltrate them to unauthorized third parties.
Audit Metadata