literature-search-biorxiv
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill queries the official bioRxiv and medRxiv APIs at api.biorxiv.org to retrieve preprint metadata and search results. These are well-known scientific services provided by Cold Spring Harbor Laboratory.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from preprint titles and abstracts. A malicious author could embed instructions in a paper's abstract that might influence the agent's behavior when processing the search results. This is a common vulnerability for literature search tools.
- [COMMAND_EXECUTION]: The skill uses 'uv run' to execute local Python scripts (search_by_dates.py and search_by_doi.py) that perform API queries and filter data.
- [REMOTE_CODE_EXECUTION]: The scripts depend on 'polite_http', a non-standard library used for enforcing rate limits. While the usage appears benign for QPS management, the dependency source is not verified in the provided files.
Audit Metadata