huggingface-paper-publisher
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages authentication securely by utilizing the
HF_TOKENenvironment variable, avoiding hardcoded secrets and adhering to standard API practices. - [SAFE]: The Python script implements robust input validation for arXiv identifiers using strict regular expression patterns (
_clean_arxiv_id), which prevents common attack vectors like path traversal or command injection via malformed IDs. - [SAFE]: Data fetched from external sources (such as the arXiv API) and user-supplied titles/abstracts are passed through a dedicated sanitization function (
_sanitize_text). This function neutralizes Markdown code-fence breakouts and YAML document delimiters, effectively mitigating risks of indirect prompt injection or data poisoning in generated files. - [SAFE]: Network communications are limited to trusted and well-known services, specifically Hugging Face (
huggingface.co) and arXiv (arxiv.org), for legitimate paper indexing and metadata retrieval. - [SAFE]: Template rendering logic uses context-aware escaping (
_escape_yaml_value) to ensure that user input cannot break the structure of YAML frontmatter in generated research articles.
Audit Metadata