Findings & checks · 7 flagged
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · tests/fixtures/safekey/vectors.json×7
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
Show all 7 locations
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
doiget
A single-binary CLI + stdio MCP server that turns DOIs and arXiv ids into local PDFs through official, OA-first APIs. Designed as the agent-facing companion to BiblioFetch.jl.
Docs: stable = the Zola site (built from main); dev = rustdoc built from next; API = docs.rs (latest published release).
Status: Shipping on crates.io (doiget-core, doiget-cli, doiget-mcp), with sigstore-signed binaries + an SBOM attached to the GitHub Release. Tier 1 + Tier 2 sources, the stdio MCP server, citation-graph expansion, and gated TDM sources are all implemented. Releases are cut by a single signed git tag through the tag-driven pipeline (see ADR-0025); release-plz was retired. See CHANGELOG.md for history and docs/PHASES.md for the phase plan.
Posture
doiget is a general-purpose automation tool for retrieving papers via official publisher APIs. By design, doiget only attempts retrieval through:
- Public Open Access sources (default — Crossref, Unpaywall, arXiv).
- Credentials the user has personally configured for their own institutional or personal subscriptions (opt-in, compile-time gated).
doiget does not work around any access control mechanism, redistribute papers, host content, operate as a SaaS, or bundle any publisher API keys.
Users are responsible for ensuring they have the right to access the content they request and for compliance with each source's Terms of Service.
See docs/LEGAL.md and docs/SCOPE.md.
Documentation
| Reader | Entry point |
|---|---|
| CLI user | This README, then doiget --help, then docs/CONFIG.md and docs/ERRORS.md for non-trivial flags / exit codes |
| Agent / MCP host integrator | docs/MCP_TOOLS.md + docs/INTEGRATION/README.md |
| Library user (Rust) | docs/PUBLIC_API.md + crates.io rustdoc |
| Contributor | CONTRIBUTING.md → docs/ARCHITECTURE.md → docs/DECISIONS/ |
| Publisher legal team | docs/LEGAL.md + CONTACT.md |
| Security researcher | docs/SECURITY.md + docs/PROVENANCE_LOG.md + docs/CAPABILITY.md |
| BiblioFetch.jl user | docs/MIGRATION.md + docs/STORE.md + docs/SAFEKEY.md |
Architecture: docs/ARCHITECTURE.md Threat model: docs/SECURITY.md Permanent non-goals: docs/SCOPE.md Phase plan: docs/PHASES.md ADRs: docs/DECISIONS/
Installation
doiget ships a single self-contained binary — the Linux build is fully static (musl), so it runs on old glibc / HPC boxes too. Every channel installs the same checksum-verified binary from the signed GitHub Release.
Shell installer (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/sotashimozono/doiget/main/scripts/install.sh | shInstalls to ~/.local/bin (override with DOIGET_INSTALL_DIR); pin a version with DOIGET_VERSION=0.6.0. The script verifies the published SHA-256 sidecar before installing.
PowerShell installer (Windows)
irm https://raw.githubusercontent.com/sotashimozono/doiget/main/scripts/install.ps1 | iexFrom crates.io (Rust toolchain)
cargo install doiget-cli # installs the `doiget` binaryFurther prebuilt-binary channels (Homebrew tap, cargo binstall, npm/npx, Nix flake, .deb) are tracked in #247. Every release asset is cosign-keyless signed (<asset>.cosign.bundle) for optional verification.
Quick start
# Fetch a paper by DOI (Open Access only by default)
doiget fetch 10.1103/PhysRevLett.130.200601
# Fetch by arXiv id
doiget fetch arXiv:2401.12345
# Batch fetch
doiget batch refs.txt
# Verify a bibliography's references resolve (no PDF download) — CI gate
doiget verify docs/references.bib --strict
# Lint a .bib for structural issues (no network): missing fields,
# blank fields, $$-display-math titles. Read-only and math-aware.
doiget lint docs/references.bib
# Inspect what was fetched
doiget info 10.1103/PhysRevLett.130.200601
# Run as MCP server (stdio)
doiget serveDefault features fetch only Open Access PDFs through Crossref / Unpaywall / arXiv. Institutional TDM access (Springer OA, APS Harvest, Elsevier ScienceDirect TDM) is not in the default published binary; it must be opted in at build time per publisher. See docs/SOURCES.md.
Coexistence with BiblioFetch.jl
doiget and BiblioFetch.jl share the same on-disk store format (TOML metadata + PDF files under a configurable store root). doiget defaults to ./papers (under the current working directory; ADR-0036), BiblioFetch.jl to ~/papers/; point both at the same root (e.g. DOIGET_STORE_ROOT=~/papers) to share one store. The shared schema, locking protocol, and atomic write contract are specified in docs/STORE.md. Reference test vectors for the shared safekey algorithm are in docs/SAFEKEY.md.
| Tool | Best for |
|---|---|
| BiblioFetch.jl | Julia REPL, research vault, citation graph exploration |
| doiget | Agents / MCP hosts, batch operations, scripted pipelines, container deployments |
License
MIT for the doiget source code and binaries (see LICENSE).
The license under which doiget retrieves papers is separate and is determined by each paper's own license, the publisher's API Terms of Service, and the user's own access rights. doiget does not relicense fetched content.
Contact
Takedown requests, security disclosures, and other formal correspondence: CONTACT.md.