Citation Intelligence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 0.10.0

Overview

The skill's citation-analysis purpose is coherent, but it asks users to run an unpinned external npm MCP server with API keys, so it should be reviewed before installation.

Review and pin the npm package version before installing, verify the publisher and source, and expose only the provider API keys you actually need for the engines you plan to query. The artifact itself does not show malicious behavior, but the unpinned external server will run with your local MCP host's privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:89

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:89-90 and SKILL.md:101-102
Vulnerability Type: Unpinned dependency execution
Risk Level: Medium

The following vulnerable configuration appears in both the Claude Code and Claude Desktop setup examples:

json

"command": "npx",
"args": ["-y", "@automatelab/citation-intelligence"]

Technical Analysis

The configuration uses npx -y to resolve and execute @automatelab/citation-intelligence without pinning an exact version. The -y option suppresses the installation confirmation prompt. As a result, the package reviewed or expected when the Skill was published is not necessarily the package that will execute later.

If the npm package, publisher account, or a future release is compromised, starting the configured MCP server could download and execute attacker-controlled package lifecycle or runtime code. The external package implementation is not included in the audited project, so its behavior and its claims concerning API-key handling cannot be independently verified from this repository.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future package release.
2. The attacker publishes a malicious version under @automatelab/citation-intelligence.
3. A user starts an MCP client configured according to SKILL.md.
4. npx -y resolves the current package version and executes it without requesting confirmation.
5. The malicious package executes with the privileges and environment of the MCP host.
6. It may read provider API keys supplied through environment variables, access files available to the user, or make unauthorized network requests.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the MCP client. The affected scope may include environment variables containing OpenAI, Anthropic, Google, or Perplexity API k ...[truncated 321 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version, such as:

  json

  "command": "npx",
  "args": ["-y", "@automatelab/citation-intelligence@0.10.0"]
  

• Verify the selected package version, publisher identity, provenance, and npm integrity metadata before deployment.

• Prefer a controlled installation with a lockfile and integrity verification rather than resolving a package dynamically whenever the MCP server starts.

• Establish an explicit dependency-update review process instead of automatically consuming future releases.

• Run the MCP server with least privilege and restrict its filesystem and network access where the host platform permits.

• Expose only the API keys required for the selected engines rather than supplying all provider credentials to the process.

• Apply the same hardened configuration to both setup examples at SKILL.md:89-90 and SKILL.md:101-102.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

Server setup

Claude Code (.claude/mcp.json):

json

{
  "mcpServers": {

Static analysis

No suspicious patterns detected.