nifs-archive-download
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard system commands (
curl,ls,stat,awk) to facilitate file downloads and local file management. These operations are limited to the project'sresources/directory and are consistent with the skill's stated purpose of archiving documents.\n- [EXTERNAL_DOWNLOADS]: The skill downloads PDF research materials directly from the official NIFS archive domain (archives.nifs.ac.jp). All network requests are targeted at this specific, legitimate institution repository.\n- [DATA_EXFILTRATION]: While the skill extracts a JWT token from the browser session, it does so only to authenticate the subsequent API requests to the NIFS archive. The token is passed to local shell scripts and used inAuthorizationheaders for the specified domain; there is no evidence of the token or any other sensitive data being sent to unauthorized third-party servers.\n- [REMOTE_CODE_EXECUTION]: The skill uses local shell scripts (batch-download.sh,download-one.sh) included in the skill package to manage the download logic. It does not fetch or execute arbitrary code from the internet.
Audit Metadata