bib-audit
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and SKILL.md body suggest using common command-line utilities for PDF text extraction and reference auditing (e.g.,
pdftotext,python3 scripts/validate_refs.py). These commands are standard for the tool's primary purpose of academic reference auditing and do not involve privilege escalation, persistence, or dangerous shell injection patterns. - [EXTERNAL_DOWNLOADS]: The scripts interact with well-known and trusted academic metadata APIs, including Crossref (
api.crossref.org), arXiv (export.arxiv.org), DataCite (api.datacite.org), and Semantic Scholar (api.semanticscholar.org). These operations are documented neutrally as they are central to the skill's function of verifying bibliographic data against official registries. - [CREDENTIALS_UNSAFE]: The skill implements safe secret management practices. It specifically instructs users to provide a Semantic Scholar API key via an environment variable (
S2_API_KEY) rather than command-line flags, preventing the key from being stored in shell history. No hardcoded credentials or private keys were found in the source code.
Audit Metadata