Security audit
Security checks across malware telemetry and agentic risk
This skill does what it claims: it verifies biomedical references using public citation services, with privacy considerations users should understand before running verification.
Install this if you are comfortable with verification sending citation identifiers and sometimes reference titles to Crossref, PubMed/NCBI, and OpenAlex. Use format-only mode for private documents, avoid setting personal API keys or USER_EMAIL unless needed, and review generated reports before using the auto-fixed bibliography.
return self.crossref_doi_cache[doi]
try:
params = urllib.parse.urlencode({"mailto": self.email})
url = "https://api.crossref.org/works/" + urllib.parse.quote(doi, safe="") + "?" + params
item = self.get_json(url).get("message", {})
record = crossref_record(item, score=1.0)
except Exception:"rows": str(limit),
"mailto": self.email,
}
url = "https://api.crossref.org/works?" + urllib.parse.urlencode(params)
items = self.get_json(url).get("message", {}).get("items", [])
records = []
for item in items:"select": "id,doi,title,display_name,publication_year,authorships,primary_location,ids",
}
)
url = f"https://api.openalex.org/works/{identifier}?" + urllib.parse.urlencode(params)
record = openalex_record(self.get_json(url), score=1.0)
except Exception:
record = None"select": "id,doi,title,display_name,publication_year,authorships,primary_location,ids",
}
)
url = f"https://api.openalex.org/works/{identifier}?" + urllib.parse.urlencode(params)
record = openalex_record(self.get_json(url), score=1.0)
except Exception:
record = None"select": "id,doi,title,display_name,publication_year,authorships,primary_location,ids",
}
)
url = "https://api.openalex.org/works?" + urllib.parse.urlencode(params)
items = self.get_json(url).get("results", [])
records = [record for item in items if (record := openalex_record(item, score=0.0))]
except Exception:parser.add_argument("--pubmed-workers", type=int, default=0, help="Concurrent PubMed DOI corroboration workers; default is 3 without NCBI_API_KEY, 10 with NCBI_API_KEY")
parser.add_argument("--openalex-workers", type=int, default=OPENALEX_DEFAULT_CONCURRENCY, help="Concurrent OpenAlex DOI/PMID corroboration workers")
parser.add_argument("--request-timeout", type=int, default=8, help="Per-request network timeout in seconds")
parser.add_argument("--ncbi-api-key", default=os.environ.get("NCBI_API_KEY") or "", help="Optional NCBI API key; raises PubMed E-utilities rate from 3 to 10 requests/second")
parser.add_argument("--openalex-api-key", default=os.environ.get("OPENALEX_API_KEY") or "", help="Optional OpenAlex API key")
parser.add_argument("--max-records", type=int, default=0, help="Limit records for testing")
parser.add_argument("--email", default=os.environ.get("USER_EMAIL") or os.environ.get("CLAWDBOT_EMAIL") or "anonymous@example.org")parser.add_argument("--openalex-workers", type=int, default=OPENALEX_DEFAULT_CONCURRENCY, help="Concurrent OpenAlex DOI/PMID corroboration workers")
parser.add_argument("--request-timeout", type=int, default=8, help="Per-request network timeout in seconds")
parser.add_argument("--ncbi-api-key", default=os.environ.get("NCBI_API_KEY") or "", help="Optional NCBI API key; raises PubMed E-utilities rate from 3 to 10 requests/second")
parser.add_argument("--openalex-api-key", default=os.environ.get("OPENALEX_API_KEY") or "", help="Optional OpenAlex API key")
parser.add_argument("--max-records", type=int, default=0, help="Limit records for testing")
parser.add_argument("--email", default=os.environ.get("USER_EMAIL") or os.environ.get("CLAWDBOT_EMAIL") or "anonymous@example.org")
parser.add_argument("--json", action="store_true", help="Print JSON instead of the chat summary")## Network risk policy - Default DOI/PMID verification is low risk and should run without asking the user each time. The payload is limited to public identifiers required for the skill's purpose. - Default requests must not include `original_text`, manuscript paragraphs, abstracts, local evidence notes, or unpublished claims. - DOI-missing recovery may send only a short, quality-checked `source.title`. - Any deep search that sends title plus abstract, surrounding context, or manuscript-derived claims is higher risk and must be separated from default batch verification.
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.