Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed journal-abbreviation helper with expected network lookups and limited file-writing behavior for BibTeX outputs and local cache files.
Installers should be comfortable with a Python CLI that contacts external journal services and writes local cache files. Use dry-run before BibTeX changes, choose output paths carefully, and avoid remote fallback lookups for confidential manuscript topics unless sharing journal names with those services is acceptable.
The tool makes outbound network requests to GitHub, AbbrevISO, and NCBI/NLM via urllib, but the finding indicates this capability is not declared in the skill permissions. Undeclared network access is a real security issue because it bypasses expected trust boundaries, can expose user input or local usage patterns to third parties, and prevents administrators from making informed allow/deny decisions.
The trigger list is overly broad and includes generic phrases like "journal name," plus a proactive-use rule for common citation/manuscript discussions. This can cause the skill to activate in contexts where the user did not ask for abbreviation lookup, increasing the chance of unnecessary tool use and unintended file/network operations.
The skill documents BibTeX-processing commands that write changes to files, but it does not require explicit user confirmation before modification. In an agentic environment with Write/Edit permissions, this raises the risk of silent or unexpected file changes to user bibliographies or related project files.
User-provided journal queries are transmitted to third-party services during fallback lookups and cache downloads without an explicit warning or consent prompt at execution time. While journal names are often low sensitivity, queries may still reveal unpublished manuscript targets, research areas, or biomedical interests, and the skill context increases concern because manuscript preparation can involve confidential work.
The rebuild action deletes all cached CSV files in the cache directory before re-downloading them, with no confirmation, backup, or safer transactional replacement. Although limited to the tool's cache directory, this is still a destructive operation that can cause data loss or disruption if invoked accidentally, and it becomes more significant in an agent context where commands may be triggered automatically.
The bib processing path writes transformed content to disk whenever dry_run is false. While the command description indicates it rewrites journal names and documents the default output path, there is no explicit caution in code comments, prompts, or user-facing warnings that running the command will create or overwrite the specified output file, which can affect user data.
