Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to perform the promised literature-screening task, but its dependency install file and CSV report handling create safety risks users should review before installing.
Install only in an isolated virtual environment after replacing yaml with a pinned PyYAML version and removing or constraining dataclasses. Confirm any language restriction and screening threshold before use, prefer JSON output for untrusted reference data, and treat all screening results as recommendations requiring human review.
scripts/main.py:374Spreadsheet Formula Injection in Generated CSV Reports
requirements.txt:1Ambiguous and Unpinned Third-Party Dependencies
The skill advertises executable workflows that read user-supplied input files and write outputs, but it does not declare any explicit tool scope such as allowed tools, path restrictions, or filesystem boundaries. In an agent setting, that ambiguity can enable over-broad file access or writes outside the intended workspace if the runtime or downstream implementation is permissive.
The natural-language criteria example explicitly restricts allowed studies to English only. The file does not present this as an optional user choice, nor does it justify the restriction as required for a region-specific or compliance-bound workflow, which conflicts with the language/locale policy guidance.
This YAML manifest/template limits allowed language to "English" without documenting whether this is optional, jurisdiction-specific, or required by a justified review protocol. In a reusable template, that broad default can ambiguously exclude non-English studies and may create unintended activation/screening behavior for users who do not intend to enforce an English-only review.
The template hard-codes an allowed language list containing only "English," which is a natural-language locale restriction. Because the file does not offer user opt-in/choice or explain a region-specific justification, it matches the policy-violation criterion for forced language constraints.
The code automatically excludes records when a heuristic language check falls below 0.5 and a language allowlist is present, without explicit confirmation that this filtering is intended for the review. In a systematic-review screening tool, silently filtering by language can bias evidence selection, omit relevant studies, and materially affect downstream conclusions or compliance with review methodology.
The dependency is unpinned, so installs may resolve to different versions over time, introducing unpredictable behavior or newly published malicious or vulnerable releases into the environment. In this specific file, dataclasses is especially questionable because it is a standard-library feature on modern Python versions and the separately published backport should only be used conditionally for older interpreters.
dataclasses
yaml
The entry yaml is unpinned and also appears to reference the wrong package name, increasing supply-chain risk because dependency resolution may pull an unexpected or typosquatted package rather than the intended library. For a screening tool that likely processes imported review data, YAML parsing libraries are security-sensitive because unsafe or compromised parser packages can expose code execution or data integrity risks.
dataclasses
yaml