qinyan-topic-analysis
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell script (
scripts/search.sh) to executecurlcommands for literature retrieval. This is a primary function of the skill and is constrained to specific academic API endpoints. - [EXTERNAL_DOWNLOADS]: The skill performs POST requests to
api.qinyanai.comto fetch research paper metadata. These requests are authenticated via a user-providedQINYAN_API_KEYand target the official vendor infrastructure. - [CREDENTIALS_UNSAFE]: The documentation correctly instructs users to manage their API keys via environment variables (
QINYAN_API_KEY) rather than hardcoding them into the scripts, which is a recommended security practice. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external research data (titles, abstracts, and metadata) from Google Scholar, ArXiv, and PubMed. While this is an ingestion surface for untrusted data, the risk is low as the data is used for academic summarization and topic analysis rather than being executed or used in sensitive logic.
Audit Metadata