paper-fetcher-vp
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()within its test suite (tests/test_paper_postprocess.py) to execute the main post-processing script. This is a standard practice for integration testing and occurs within the local environment without using untrusted external input. - [DATA_EXPOSURE]: The skill interacts with local file paths (e.g.,
E:\LLM_wiki\...) and writes metadata sidecar files (.metadata.json). This behavior is consistent with its stated purpose of organizing a local research vault and does not involve exfiltration to external domains. - [REMOTE_CODE_EXECUTION]: While the skill instructions mention downloading PDFs from official sources (arXiv, OpenReview), the code itself (
paper_postprocess.py) only handles the post-processing of local files. It performs header verification (%PDF-) to ensure downloaded files are valid PDFs before moving them, providing a safety check against malicious or malformed downloads. - [SAFE]: The skill follows best practices for academic paper management by prioritizing official identifiers (arXiv ID, DOI) and avoiding the storage of Zotero API credentials or the direct editing of database files. All identified Python packages used in the scripts are standard library modules (
argparse,json,pathlib,shutil).
Audit Metadata