arxiv-analyze
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches research paper content and metadata from
arxiv.org,arxiv2md.org, andar5iv.labs.arxiv.org. These network operations are strictly limited to the skill's stated purpose and target well-known, relevant services. - [COMMAND_EXECUTION]: The
arxiv_fetch.pyscript uses standard Python libraries for filesystem management, including creating a local cache and maintaining rate-limit state. It utilizes atomic file replacement for state persistence and incorporates the securedatafilter during tarball extraction to prevent directory traversal vulnerabilities on supported Python versions. - [DATA_EXFILTRATION]: No unauthorized data transmission was identified. The skill does not access sensitive local files or environment variables for export; all network requests are directed towards official or reputable paper conversion endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external text from research papers, which presents an inherent surface for indirect prompt injection. However, the instructions focus on producing a structured summary and do not provide a path for embedded instructions to execute commands or influence the agent's system state.
Audit Metadata