Security audit
Security checks across malware telemetry and agentic risk
This skill has a coherent paper-metadata purpose, but it automatically searches broad local directories and executes discovered helper scripts without strong provenance checks.
Install only if you are comfortable with paper identifiers or titles being sent to OpenAlex/Crossref and with the skill running locally discovered journal helper scripts. In sensitive environments, avoid setting helper CLI environment variables unless the paths are trusted, consider using --no-if and --no-abbrev, and do not use private or unpublished paper titles unless outbound lookup is acceptable.
def _call_cli(path, args, timeout=40):
try:
p = subprocess.run([sys.executable, path, *args, "--format", "json"],
capture_output=True, text=True, timeout=timeout)
except (subprocess.TimeoutExpired, OSError):
return None# --------------------------------------------------------------------------- #
def openalex_fetch(id_type, value):
"""Return an OpenAlex work dict, or raise MetaError."""
base = "https://api.openalex.org/works"
try:
if id_type == "doi":
return _get_json("%s/https://doi.org/%s" % (base, urllib.parse.quote(value, safe="/")))# --------------------------------------------------------------------------- #
def crossref_fetch(doi):
try:
msg = _get_json("https://api.crossref.org/works/%s" % urllib.parse.quote(doi, safe="/"))["message"]
except urllib.error.HTTPError as e:
if e.code == 404:
raise MetaError("not_found", "No paper matched DOI: %r" % doi, exit_code=3)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.