Security audit

Reference Style Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill’s reference-formatting purpose is coherent, but it needs review because its script can overwrite any writable output path and its CSV export does not neutralize spreadsheet formulas.

Install only if you are comfortable reviewing output paths before every run. Use a dedicated output directory, avoid overwriting existing files unless intended, treat processed bibliography metadata as untrusted, and be cautious opening exported CSV files in spreadsheet software. The package should remove the unnecessary dependency and add path, overwrite, extension, and CSV formula protections before broad use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unnecessary Unpinned Third-Party Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:609
Finding: Spreadsheet Formula Injection in CSV Export
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:780
Finding: Unrestricted Output Path Allows Arbitrary File Overwrite
Content: View full analysis
'ReferenceSync': """Export bibliography""" path = Path(filepath) exporter = ReferenceExporter(style) ext = path.suffix.lower() if ext == '.bib': content = exporter.export_bibtex(self.references) elif ext == '.ris': content = exporter.export_ris(self.references) elif ext == '.json': content = exporter.export_json(self.references) elif ext == '.csv': content = exporter.export_csv(self.references) else: # Default BibTeX content = exporter.export_bibtex(self.references) with open(filepath, 'w', encoding='utf-8') as f: f.write(content) ``` ### Technical Analysis The output path is accepted directly from the command-line argument and opened in write mode. The implementation does not: - Restrict output to an approved workspace. - Reject absolute paths or traversal outside an allowed root. - Detect symbolic links. - Prevent overwriting an existing file. - Confirm that the destination is an expected bibliography file. Opening the destination with mode `w` truncates an existing file before writing. Consequently, anyone able to influence the Skill's output argument can replace any file writable by the account running the Skill. The fallback behavior also writes BibTeX content to paths with unsupported extensions, so an extension check does not constrain the target. This does not independently bypass operating-system permissions. The write remains limited to files writable by the current process. ### Attack Path 1. An attacker or untrusted instruction influences the `--output` argument. 2. The supplied path points to an existing sensitive file writable by the current user, or to a symbolic link resolving ...[truncated 785 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and documents file-reading and file-writing behavior via scripts/main.py and CLI parameters, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent or runtime may permit broader filesystem actions than reviewers expect, increasing the risk of unintended file access or overwrite if the skill is invoked with attacker-controlled paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'When to Use' section broadens invocation beyond reference synchronization into generic academic writing tasks, which can cause the skill to be selected for requests outside its validated scope. In agentic systems, overbroad routing language is dangerous because it increases the chance that a file-processing skill with write capability is invoked in inappropriate contexts, leading to unsafe assumptions, misuse of inputs, or execution against unrelated documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code performs a direct file write using write mode, which can overwrite existing user data at the destination path. Although the script prints a message after exporting, there is no pre-write confirmation, warning comment/docstring about overwrite behavior, or other user disclosure near the destructive operation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses

Static analysis

No suspicious patterns detected.