Security audit
Security checks for vulnerabilities and agentic risk
This is a local conflict-checking script with some reliability and documentation issues, but no evidence of hidden access, exfiltration, persistence, or destructive behavior.
Install only if you are comfortable running a draft local Python tool on reviewer and publication data. Treat its output as advisory because the demo path and unused institutional check contain bugs; use a controlled CSV path and avoid sharing generated conflict results in a public or collaborative workspace.
The metadata says the skill checks co-authorship conflicts, but the analysis indicates additional institutional conflict checking and a broken function using an undefined reviewer variable. Undeclared behavior undermines user trust and reviewability, while the broken logic can cause incorrect conflict decisions, crashes, or inconsistent handling of sensitive review data.
The skill declares local file-reading capability through its documented use of publication CSV inputs, but it does not define any explicit tool scope or permissions boundary. This creates ambiguity about what files the skill is allowed to access and increases the risk of unintended or overly broad file reads if the implementation accepts arbitrary paths.
The manifest says the skill checks for co-authorship conflicts between authors and suggested reviewers, which implies a specific conflict type. The code additionally implements institutional-conflict detection logic, expanding behavior beyond the declared scope even though that capability is not reflected in the manifest description.
The institutional-conflict function claims to detect conflicts but references an undefined variable reviewer, so it will fail if called and cannot produce the documented result. In a conflict-screening skill, this can cause missed or broken conflict checks, leading users to rely on incorrect outputs when making reviewer-selection decisions.
The skill states that output files may be written to the workspace but does not clearly warn that those artifacts could contain sensitive conflict-of-interest assessment results. In peer-review or editorial contexts, even low-volume leakage of reviewer conflict data can expose confidential relationships or recommendations to other workspace users or downstream tools.
No suspicious patterns detected.
