mlava/scholar-sidekick-api
Resolve scholarly identifiers (DOI, PMID, PMCID, ISBN, arXiv, ISSN, ADS bibcode, WHO IRIS URL) into formatted citations (10,000+ CSL styles) and bibliography exports (BibTeX, RIS, EndNote, CSV…), and check retraction, open-access, and citation-fabrication status — for one citation or a whole bibliography at once. Calls a documented REST API over plain HTTP — no install, no API key needed for the free tier. Use when the user has a DOI, PMID, PMCID, ISBN, arXiv ID, ISSN, ADS bibcode, or WHO IRIS URL and asks to format a citation, build or export a bibliography, check whether a paper is retracted, open-access, or a fabricated citation, or audit every reference in a .bib/.ris/CSL-JSON bibliography.
78
98%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly instructs callers to include a first‑party key (prefixed "ssk_…") as an Authorization: Bearer header (and mentions X‑RapidAPI‑Key), which encourages embedding secret API keys directly into curl commands or generated requests — creating an exfiltration risk if the LLM prints or echoes the actual secret verbatim.
- Audited
- Security analysis