huggingface-papers
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [External Data Fetching]: The skill uses
curlto retrieve paper information from Hugging Face (huggingface.co) and arXiv (arxiv.org). Fetching data from these well-known research repositories is a standard part of the skill's functionality to provide summaries and metadata to the user. - [Command Usage with Placeholders]: The instructions include shell commands with placeholders like
{PAPER_ID}. While these are used to interact with the Hugging Face API, it is important for the agent to properly validate and parse these identifiers from user input to ensure they match the expected format (e.g., arXiv IDs). The skill provides a parsing table to help guide the agent in this process. - [Processing External Content]: By design, this skill reads research papers which are user-contributed content. This introduces a surface for indirect prompt injection, where instructions embedded in a paper's text could potentially influence the agent's response. The skill includes guidance on parsing IDs which helps define the expected scope of the input and the agent's subsequent actions.
- [Token-Based Authentication]: Certain administrative tasks, such as indexing or claiming papers, require the use of a
$HF_TOKEN. The skill correctly references this as an environment variable rather than hardcoding any credentials, following security best practices for API integration.
Audit Metadata