verify-citations
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary logic is contained within a deterministic Python script (
scripts/check_bibtex.py) that uses only standard library components. - [EXTERNAL_DOWNLOADS]: The script performs network lookups against well-known scholarly APIs including api.crossref.org, api.datacite.org, export.arxiv.org, dblp.org, and api.semanticscholar.org. These are legitimate well-known services required for the skill's functionality and are accessed using standard API etiquette, including rate-limiting and User-Agent identification.
- [DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The script transmits only non-sensitive bibliographic metadata (titles, DOIs, etc.) to academic search indexes for verification purposes. The requirement for a contact email is a standard requirement for 'polite' access to these scholarly APIs.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute the bundled Python script. The script itself does not use any unsafe execution patterns such as
eval,exec, or shell-based sub-processes to run arbitrary commands.
Audit Metadata