paper-fulltext-harvest
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the automated download of academic papers from reputable scholarly sources and publisher APIs, including Elsevier ScienceDirect, Wiley Online Library, Springer Nature, Crossref, Unpaywall, and OpenAlex. These are well-known services within the scientific research ecosystem.
- [COMMAND_EXECUTION]: The skill provides CLI commands (e.g.,
python -m auto_paper_download,python scripts/redownload_elsevier.py) for the agent to execute its paper-harvesting scripts. These commands are used as intended for the skill's primary functionality. - [CREDENTIALS_UNSAFE]: The skill requires several API keys and institutional tokens for full-text access. It follows security best practices by instructing users to manage these via an environment file (
.env) and provides a safe template (.env.example) with no hardcoded secrets. - [DATA_EXFILTRATION]: The core logic of the skill involves fetching external data (PDFs and XML) and saving it to a local directory (
output_dir). There is no evidence of local sensitive data being sent to unauthorized external destinations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests lists of DOIs (Digital Object Identifiers) from external files such as Web of Science exports or Excel spreadsheets. The code implements regex validation (
r"10\.\d{4,9}/[\x21-\x7E]+") to sanitize these identifiers before they are used in API requests and file path generation, mitigating the risk of processing malicious inputs. - [OBFUSCATION]: No malicious obfuscation, hidden characters, or homoglyphs were detected in the instructions or scripts.
Audit Metadata