Skills
Navigate
skills/wentorai/research-claw/sci-papers-downloder/Gen Agent Trust Hub

sci-papers-downloder

Fail

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The script scripts/search_scopus.py contains a hardcoded API key used for accessing the Elsevier/Scopus API.
  • Evidence: DEFAULT_ELSEVIER_API_KEY = "1a86a22a0f4dac7995ff6185cba431c2".
  • [EXTERNAL_DOWNLOADS]: The skill includes logic to automatically fetch code from an untrusted external Git repository if the required tool is not found locally.
  • Evidence: scripts/download_open_access.py defines UVX_FALLBACK_CMD = ["uvx", "--from", "git+https://github.com/Oxidane-bot/scihub-cli.git", "scihub-cli"].
  • [REMOTE_CODE_EXECUTION]: Code fetched from the untrusted external repository is executed at runtime via the uvx tool.
  • Evidence: The attempt_scihub_fallback function in scripts/download_open_access.py executes the fallback command using subprocess.run().
  • [COMMAND_EXECUTION]: The skill uses shell command execution to perform its primary functions, including the execution of potentially downloaded third-party scripts.
  • Evidence: subprocess.run() is used in scripts/download_open_access.py to execute command-line tools with arguments derived from search results and user inputs.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 17, 2026, 12:19 AM
Security Audit — agent-trust-hub — sci-papers-downloder