Security audit
Security checks for vulnerabilities and agentic risk
The package is not malicious, but its documentation materially overstates what the citation formatter can do and its batch mode can overwrite a chosen output file without protection.
Review this skill before installing if you need anything beyond simple local AMA citation formatting. Do not rely on its advertised 1000+ styles, validation, bibliography generation, journal compliance, or reference-manager integration unless those features are added and tested. When using batch mode, choose a new output file path to avoid overwriting existing work.
The skill claims broad citation-conversion, validation, compliance, and integration capabilities that the implementation does not actually provide. This is dangerous because users or downstream agents may rely on fabricated or overstated functionality for academic submission workflows, producing incorrect references, false compliance assurances, or silently degraded outputs.
The skill advertises executable scripts and example workflows that imply file access, but it declares no explicit tool scope or permissions boundaries. In an agent environment, this can cause the orchestrator or user to underestimate the skill's access needs, increasing the risk of unintended file reads or writes when the packaged code is invoked.
The manifest description bundles many loosely bounded use cases and strong assurances without clear invocation limits. This increases the chance of over-selection by planners or users and makes the skill more dangerous because the surrounding documentation already overstates capabilities, compounding trust in unsupported behavior.
The trigger language is broad enough to catch generic academic-writing tasks, not just citation formatting. In an agent-routing context, overbroad invocation criteria can cause the wrong skill to be selected, exposing user files to unnecessary processing and yielding outputs outside the tool's actual competence.
The examples and CLI documentation describe APIs, classes, methods, and command-line options that are not supported by the documented implementation surface. This can mislead an agent into generating or executing invalid commands and code paths, causing operational failure and potentially unsafe fallback behavior if callers attempt ad hoc substitutions.
The manifest describes converting between citation styles such as APA, MLA, Vancouver, and Chicago and supporting 1000+ academic styles, but this file's implementation is narrowly focused on parsing a small set of input formats and always emitting AMA output. The module docstring, CLI description, and main formatting path all indicate a single-output-style converter rather than a general citation formatter.
The summary phrase "Use when working with citation formatter" is overly broad and can cause the skill to activate in situations where citation formatting is only loosely related to the user's request. Overbroad activation increases the chance of unnecessary invocation, which can expose user content to the skill unexpectedly or interfere with more appropriate tooling.
The top-level docstring explicitly states this tool converts citations to AMA style, while the manifest presents it as a general formatter for APA, MLA, Vancouver, Chicago, and 1000+ styles. This is an active documentation-versus-intent inconsistency about the skill's true scope.
The implementation provides single-citation formatting, interactive input, stdin handling, and simple batch processing from a text file, but there is no bibliography construction logic, journal compliance workflow, or integration with reference managers. This is a narrower operational scope than the manifest advertises.
Batch mode opens the user-supplied output path with write mode, which will truncate an existing file without confirmation. In an agent or automated workflow, a mistaken or influenced output path could overwrite user data, causing integrity loss even though this is not a code-execution issue.
No suspicious patterns detected.
