Security audit
Security checks for vulnerabilities and agentic risk
The skill is a straightforward bioRxiv lookup helper that fetches public preprint metadata, with minor date-handling documentation bugs but no hidden access or persistence.
This skill is reasonable to install if you want bioRxiv metadata lookup. Be aware that its default and --days behavior may fetch a broader date range than expected, so use explicit --start and --end dates when you need precise recency.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import sys
BIO_RXIV_API = "https://api.biorxiv.org/details/biorxiv"
COLLECTIONS = [
"bioinformatics", "genomics", "molecular-biology", "cell-biology",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import sys
BIO_RXIV_API = "https://api.biorxiv.org/details/biorxiv"
COLLECTIONS = [
"bioinformatics", "genomics", "molecular-biology", "cell-biology",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import sys
BIO_RXIV_API = "https://api.biorxiv.org/details/biorxiv"
COLLECTIONS = [
"bioinformatics", "genomics", "molecular-biology", "cell-biology",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import sys
BIO_RXIV_API = "https://api.biorxiv.org/details/biorxiv"
COLLECTIONS = [
"bioinformatics", "genomics", "molecular-biology", "cell-biology",
The docstring states that the function gets papers from the last N days, suggesting behavior tied to the days argument. In reality, it discards the days parameter and simply calls get_papers with start_date=None and end_date=None, which triggers the broad default date behavior instead.
The inline comment at L058 says the function defaults to the last 30 days when no dates are provided. However, the implementation sets start_date to 2020-01-01 and end_date to today's date, which is a much broader range and directly contradicts the comment.
No suspicious patterns detected.