lit-search
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
install.shscript downloads the officialuvinstallation script fromhttps://astral.sh/uv/install.sh. This is a well-known infrastructure service for the Python ecosystem. - [COMMAND_EXECUTION]: The skill uses the
claudeCLI via subprocess inscreen_host.pyto perform title and abstract screening when the user selects the host model backend. The implementation uses structured argument lists to mitigate shell injection risks. - [SAFE]: The skill implements risk mitigation for indirect prompt injection by using explicit boundary markers (e.g.,
### key:) and regex-based HTML sanitization when interpolating external literature data into LLM prompts.
Audit Metadata