arxiv-analyze

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches research paper content and metadata from arxiv.org, arxiv2md.org, and ar5iv.labs.arxiv.org. These network operations are strictly limited to the skill's stated purpose and target well-known, relevant services.
  • [COMMAND_EXECUTION]: The arxiv_fetch.py script uses standard Python libraries for filesystem management, including creating a local cache and maintaining rate-limit state. It utilizes atomic file replacement for state persistence and incorporates the secure data filter during tarball extraction to prevent directory traversal vulnerabilities on supported Python versions.
  • [DATA_EXFILTRATION]: No unauthorized data transmission was identified. The skill does not access sensitive local files or environment variables for export; all network requests are directed towards official or reputable paper conversion endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external text from research papers, which presents an inherent surface for indirect prompt injection. However, the instructions focus on producing a structured summary and do not provide a path for embedded instructions to execute commands or influence the agent's system state.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 02:48 PM