p-pdf-download

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFECOMMAND_EXECUTION

Full Analysis

[COMMAND_EXECUTION]: The script scripts/pdf_download.py uses subprocess.run() to invoke the scansci-pdf CLI tool.
The command is constructed as a list of strings, which is a security best practice that prevents shell injection.
It executes a specific tool ('scansci-pdf') defined by the user's environment or a configurable argument.
The input DOI values are sanitized using regex before being passed as arguments to the tool.

Audit Metadata

Risk Level

SAFE

Analyzed

Jul 10, 2026, 03:10 AM