The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to several well-known academic services including DOI.org, CrossRef (api.crossref.org), NCBI E-utilities (eutils.ncbi.nlm.nih.gov), arXiv (export.arxiv.org), and DataCite (api.datacite.org). These are standard research infrastructure APIs and are treated as safe, well-known services.
[COMMAND_EXECUTION]: The skill instructions and documentation provide several examples of executing local Python scripts (search_google_scholar.py, search_pubmed.py, extract_metadata.py, etc.) via the Bash tool. This is the intended primary functionality of the skill and no evidence of arbitrary or malicious command injection was found.
[CREDENTIALS_UNSAFE]: The Python scripts follow best practices for secret management by retrieving authentication data (e.g., NCBI_API_KEY, NCBI_EMAIL) from environment variables rather than hardcoding them within the source code.
[NO_CODE]: The documentation in SKILL.md mentions a script scripts/generate_schematic.py for creating visual diagrams, but this specific file is missing from the provided skill files. This does not pose a security risk but is a functional omission.

citation-management