nature-academic-search
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to well-known academic data providers, including PubMed (NCBI), CrossRef, arXiv, and OpenAlex. These operations are required for the skill's primary functionality and target official API endpoints.
- [DATA_EXFILTRATION]: No evidence was found of exfiltrating sensitive local data. The skill transmits only research-related queries and author identifiers to academic services. Secret management for API keys follows industry best practices by utilizing environment variables and local user configuration files rather than hardcoded secrets.
- [DYNAMIC_EXECUTION]: A dynamic module import (
__import__) was identified in the test suite (mcp-server/tests/test_sources.py). Analysis confirms this is a standard testing pattern used for patching classes during unit tests and does not represent a security vulnerability in the production code. - [COMMAND_EXECUTION]: The skill uses the
uvtool to manage and run the MCP server in an isolated environment. The command-line arguments are static and define the necessary runtime dependencies for the server, posing no risk of arbitrary command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted literature data (such as abstracts and titles) from the web. It mitigates potential injection risks by applying a sanitization function (
ris_escape) that strips HTML tags before formatting or presenting metadata.
Audit Metadata