academic-paper-download

Warn

Audited by Socket on Aug 14, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/paper_fetch/cli.py

This file is primarily a well-structured CLI orchestrator for DOI/title resolution and artifact download/saving, with idempotency and progress reporting. It does not show classic malware mechanics (no exec/subprocess, no obfuscation, no direct exfiltration). However, it enables a Sci-Hub fallback by default unless explicitly disabled via PAPER_FETCH_NO_SCIHUB, which materially increases the package’s abuse/policy risk profile. Because the actual network destinations, PDF handling, and filesystem/path safety are implemented in imported modules, malware intent cannot be confirmed from this fragment alone, but the overall security risk remains elevated due to the default-on illicit-content retrieval capability.

Confidence: 56%Severity: 62%
Audit Metadata
Analyzed At
Aug 14, 2026, 11:38 AM
Package URL
pkg:socket/skills-sh/tiangong-ai%2Fskills%2Facademic-paper-download%2F@beb75704875e59cc13fd072a18ee83a8028d2d773dbdfb675cfb328d19320385
Security Audit — socket — academic-paper-download