nature-downloader
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes its own Python and Node.js scripts for configuration, health checks, and batch downloading. Static analysis flags for subprocess usage in tests were reviewed and found to be benign parts of the testing suite.
- [DYNAMIC_EXECUTION]: The skill uses JavaScript evaluation through a Chrome DevTools Protocol (CDP) proxy to automate browser navigation, extract metadata, and solve bot challenges (e.g., slider CAPTCHAs). This is the intended and documented behavior for a browser-based downloader.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from well-known academic services including Crossref, Europe PMC, arXiv, Unpaywall, and official publisher API endpoints for Elsevier and IEEE. These interactions are required for the skill's primary function.
- [CREDENTIALS_UNSAFE]: The skill handles publisher API keys but implements several security controls: keys are stored with restricted '0600' file permissions, masked to show only the last four digits in CLI output, and automatically redacted from batch manifests to prevent accidental exposure.
Audit Metadata