zenodo
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads research data files from the official Zenodo repository (zenodo.org or sandbox.zenodo.org) as part of its core functionality.
- [COMMAND_EXECUTION]: The bundled Python helper script performs file system operations (directory creation and file writing) and network requests to the Zenodo API.
- [CREDENTIALS_UNSAFE]: Authentication tokens are managed securely through the environment variable
ZENODO_ACCESS_TOKEN. The skill includes instructions to avoid hardcoding secrets in the repository and provides a template for configuration. - [DATA_EXFILTRATION]: User-provided metadata and local files are transmitted to Zenodo's infrastructure during the deposit, update, and upload processes as intended by the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Zenodo API (search results and file downloads). While it does not directly execute this content, the downloaded files could influence subsequent agent actions. The implementation mitigates path-based attacks via the
safe_output_pathfunction inscripts/zenodowhich ensures filenames do not contain traversal patterns.
Audit Metadata