The Agent Skills Directory

[SAFE]: The skill uses official, well-known academic REST APIs for searching scholarly literature. All remote connections are to established domains belonging to reputable organizations such as the National Institutes of Health (NIH), Cornell University, and the Allen Institute for AI.
[DATA_EXPOSURE]: The skill instructions advise the agent to look for API keys in environment variables or a local .env file. This is a standard and safe practice for secret management in developer-centric tools and does not constitute hardcoding of credentials.
[DATA_EXFILTRATION]: While the skill performs network operations using tools like curl or WebFetch, these are limited to the specific academic database endpoints documented in the reference files. No evidence of exfiltration of sensitive user data was found.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external data (paper abstracts and metadata) from the internet, creating a potential indirect prompt injection surface. This is considered low risk due to the authoritative and curated nature of the databases used.
Ingestion points: REST API responses from PubMed, PMC, bioRxiv, medRxiv, arXiv, OpenAlex, Crossref, Semantic Scholar, CORE, and Unpaywall.
Boundary markers: The skill instructs the agent to structure results using specific markdown headers (e.g., '### PubMed'), which provides basic structural separation for fetched content.
Capability inventory: The skill utilizes platform-specific fetch tools or curl. No capabilities for file-system modification or execution of the fetched data are present.
Sanitization: Data is processed as raw JSON or XML; the agent relies on its inherent formatting capabilities to present the results safely.

paper-lookup