Literature Review

• Outcome: Review
• Latest audit: May 28, 2026 · 2:08 PM UTC
• Version: 1.3.0

Overview

The skill mostly matches its literature-review purpose, but it should be reviewed because it mandates an external AI figure workflow that is under-scoped and references a missing helper script.

Install only if you are comfortable with external academic database queries, DOI verification, local pandoc/xelatex PDF processing, and the skill's mandatory AI schematic workflow. Avoid using confidential unpublished references or sensitive research plans unless you are comfortable with the related third-party API and AI-generation exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        print(f"Generating PDF: {output_pdf}")
        print(f"Command: {' '.join(cmd)}")
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        print(f"✓ PDF generated successfully: {output_pdf}")
        return True
    except subprocess.CalledProcessError as e:

• Confidence: 88% confidence
• Finding: The script executes an external binary (pandoc/xelatex) on attacker-influenced inputs such as the markdown file, bibliography, template, and CSL path. Although shell injection is mitigated by passing a list to subprocess.run, processing untrusted document content through pandoc/LaTeX can trigger risky file reads, network fetches, or exploitation of vulnerabilities in those external tools, which is more dangerous in an agent skill that may handle arbitrary user-supplied literature content.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill makes AI-generated figures mandatory and routes users into a separate schematic-generation workflow that is not essential to performing a literature review. This expands execution scope, introduces unnecessary script/tool invocation, and increases the chance of unintended external model calls or unsafe file operations unrelated to the user's core task.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill advertises integration with unrelated analysis domains such as RNA-seq, single-cell, and sequence analysis, which broadens the operational scope beyond literature review. Unnecessary adjacent capabilities can lead an agent to invoke more powerful downstream tools than needed, increasing attack surface and the risk of over-collection, code execution, or task drift.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script extracts DOIs from a user-supplied file and automatically sends them to external DOI and CrossRef endpoints during verification. Even though DOIs are not usually secrets, they can reveal unpublished references, internal research topics, or sensitive document contents, and the skill context involves literature reviews where prepublication or confidential citation lists may be present.

Static analysis

No suspicious patterns detected.