Audit History

This is a legitimate research management tool for Semantic Scholar. Static findings flagged 185 potential issues, but manual evaluation confirms all are false positives. The skill uses Python CLI scripts for cookie-based API access, standard file paths (~/.auth/), and base64 encoding for decoding server-side rendered data. No malicious patterns, data exfiltration, or unauthorized credential usage detected.

This is a legitimate academic research tool for interacting with Semantic Scholar APIs. All static findings are false positives: Python subprocess calls use hardcoded command strings with no user injection, hardcoded URLs are all legitimate Semantic Scholar endpoints, filesystem access is to user-specific config directories, and base64 decoding is for legitimate SSR data extraction. The skill uses cookie-based authentication which is a standard pattern for accessing authenticated web APIs.