qinyan-paper-search
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
api.qinyanai.comto fetch academic literature data. This is the official API endpoint for the service described in the skill and is required for its primary functionality. - [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API keys via the
QINYAN_API_KEYenvironment variable rather than hardcoding them in scripts or instructions. This aligns with secure configuration practices. - [COMMAND_EXECUTION]: The
scripts/search.shscript executescurlandpython3. It usesset -euo pipefailfor robust error handling and validates that thePAYLOADis valid JSON using a Python one-liner before sending it to the API, which helps prevent malformed data injection. - [DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. The script only sends the user's search query parameters to the specified academic database provider.
Audit Metadata