The Agent Skills Directory

[SAFE]: The skill is professionally implemented with a strong security posture regarding external data processing.\n- [SAFE]: Input validation is performed on arXiv identifiers within the _clean_arxiv_id method. By using strict regular expression patterns (\\d{4}\\.\\d{4,5}(v\\d+)?), the script prevents path traversal, SSRF, or command injection via malformed IDs when constructing URLs for the Hugging Face Hub and arXiv APIs.\n- [SAFE]: The skill implements thorough sanitization for handling untrusted content from the arXiv API (Evidence: 1. Ingestion points in get_arxiv_info; 2. Boundary markers  are present in _add_paper_to_readme; 3. Capability inventory includes local file writes in create_research_article and Hub README updates in link_paper_to_repo; 4. Sanitization is implemented via _sanitize_text and _escape_yaml_value). These measures neutralize potential markdown code-fence breakouts and YAML document delimiters in external research metadata.\n- [SAFE]: Authentication is handled via the standard HF_TOKEN environment variable, ensuring that sensitive credentials are not hardcoded and follow the Hugging Face platform's recommended security practices.

hugging-face-paper-publisher