The Agent Skills Directory

[SAFE]: No security issues were detected. The skill follows standard development practices for handling external resources and environment variables.
[EXTERNAL_DOWNLOADS]: Fetches scientific data and publications from well-known and trusted organizations including NCBI (PubMed), Crossref, NIH (iCite), OpenAlex, and official AWS S3 buckets for PubMed Central Open Access data.
[DYNAMIC_EXECUTION]: The skill uses importlib.import_module to load the 'requests' library dynamically. In both instances (scripts/common.py and scripts/pmc_open_access.py), the module name is hardcoded, which prevents arbitrary module loading or command injection.
[CREDENTIALS_UNSAFE]: Sensitive information such as USER_EMAIL and NCBI_API_KEY are managed through environment variables or a .env file template, adhering to secure credential management practices. No hardcoded secrets were found.
[COMMAND_EXECUTION]: The skill provides scripts for processing and merging search results. It includes robust filename sanitization (safe_filename) and validates that downloaded content corresponds to expected file headers (e.g., verifying PDF magic bytes) to prevent path traversal and basic payload spoofing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from scientific abstracts and excerpts. However, it treats this content purely as data for synthesis and does not perform any sensitive operations, command execution, or evaluation based on the retrieved text.

jinko-task-literature-search