arxiv
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches paper metadata and abstracts from the official arXiv (export.arxiv.org) and Semantic Scholar (api.semanticscholar.org) APIs.
- [COMMAND_EXECUTION]: The skill uses
curlto fetch API data and pipes the results topython3for parsing. The analysis confirms these commands use inline scripts (-c) or local files (scripts/search_arxiv.py) to process data from the remote source as XML/JSON. This is a safe data-processing pattern and does not constitute execution of remote code. - [SAFE]: The automated security alerts regarding remote code execution are identified as false positives. The reported patterns involve piping API data into a local Python parser rather than executing content from the URL as code. The included script
scripts/search_arxiv.pyuses only Python standard library components and follows secure data fetching practices.
Audit Metadata