Security audit
Security checks for vulnerabilities and agentic risk
This research helper needs review because citation links can reach private services, offline mode can still transmit data, and verification results can overstate certainty.
Use a reviewed, fixed version in an environment that blocks private-network access. Independently check important citations and retraction status. Disable caching and use --workers 1 when comparing conflicting references. For confidential material, enforce network blocking externally; --offline alone is insufficient when optional model endpoints are configured.
.Unchecked redirects allow citation URLs to reach private-network services
An attacker can cause otherwise-blocked internal HTTP requests and obtain limited reachability/status information through the verification result. Internal endpoints with side effects on HEAD or GET can also be invoked. This code path does not return response bodies, so arbitrary internal-data disclosure is not established.
The supplied code has a materially different primary purpose from the declared research and citation-checking functionality. It validates skill metadata and prints packaging guidance; it does not search literature, query citation registries, verify identifiers or retractions, or export bibliographies. Metadata validation could be a development utility within a larger research skill, but this chunk contains no connection to the declared workflow. No network access, file modification, or code execution beyond the validator itself is evident.
Successful PubMed reverse and locator lookups return verified before running retraction checks, and the regular PMID-only path also lacks equivalent retraction screening. Retracted papers can therefore receive a clean-looking verdict and enter verified-only exports, which is especially consequential in this skill's medical and submission workflows.
The final verdict gate assigns verified based on source tier and field completeness without requiring successful registry metadata verification. Failed or skipped DOI/PMID checks can therefore leave a reachable citation eligible for verified, undermining the skill's central authenticity guarantee and potentially laundering fabricated references.
The disk-cache key excludes semantic input, but a cache hit returns the previous semantic_audit instead of rebuilding it from the current citation. A newly supplied contradicted or not_in_source judgment can consequently be replaced by an older favorable judgment, bypassing the subsequent semantic cap and retaining verified status.
Parallel work deduplication keys only on an identifier or normalized URL, although verification also depends on the claimed title, authors, source, and other fields. Followers inherit the leader's result and even its displayed citation fields, so conflicting claims can disappear rather than receive independent verification; duplicate downgrading does not restore the lost evidence.
The final verdict logic can assign verified based on reachability, source tier, and field completeness without requiring successful metadata verification. Registry failures therefore fail open, and attacker-supplied tier values or loosely matched authoritative-looking hostnames further weaken the gate; this is particularly dangerous for a skill whose core purpose is detecting fabricated citations.
The persistent cache key excludes semantic input, but cached payloads retain semantic and semantic_audit fields. On a cache hit, a new contradicted or not_in_source assessment can be replaced by the previous assessment, so apply_semantic_cap fails to enforce the current negative evidence.
Parallel deduplication keys references only by an identifier and copies the leader's complete result to followers without validating their distinct titles, authors, sources, or secondary identifiers. A fabricated reference sharing a real identifier can consequently disappear behind another reference's identity and judgment; later duplicate marking may downgrade it to partial but does not recover the missing mismatch detection.
The documented npx skills add docsor1212/cite-holmes command executes an unpinned npm CLI and installs skill content from an unpinned repository reference. A compromised future release or upstream repository could introduce code or agent instructions that run with the user's permissions; this is a supply-chain risk, not evidence of malicious intent or an MCP-specific flaw.
This repeated installation example has the same unpinned CLI and repository supply-chain exposure as the earlier command. Although it is ordinary installation guidance rather than an instruction to bypass security, following it can execute a subsequently compromised npm release and introduce unreviewed skill instructions.
Without declared permissions the skill's intent is opaque and cannot be validated.
Although the match is in a comment, the associated uvx command installs and executes code from a GitHub repository without an immutable revision. The MCP client configurations repeat this mutable source, so a compromised repository or malicious upstream change could execute code with the client's permissions, potentially accessing local research, files, or available credentials.
Running uvx against a local checkout is not inherently an unpinned remote installation, but the documented workflow first clones the repository's current default branch without checking out a reviewed revision. Following the complete workflow therefore executes mutable upstream code, creating the same supply-chain exposure at checkout time; the README alone does not demonstrate malicious behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if len(cn) >= 12 and (_OPTS.get("openalex_key") or ""):
try:
q = quote(claimed.strip(), safe="")
url = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=1"
f"&select=display_name&api_key={quote(_OPTS['openalex_key'], safe='')}")
if _cb_open(url):
return ""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if len(cn) >= 12 and (_OPTS.get("openalex_key") or ""):
try:
q = quote(claimed.strip(), safe="")
url = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=1"
f"&select=display_name&api_key={quote(_OPTS['openalex_key'], safe='')}")
if _cb_open(url):
return ""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# v3.6 --cn 回源：api.crossref.org/works/{doi} 返回同构 CSL(message 字段)。
# 独立主机不计入 doi.org 断路器；失败静默回原路径。
try:
cr_url = f"https://api.crossref.org/works/{quote(doi, safe='()/')}"
cr_req = urllib.request.Request(cr_url, headers={
"User-Agent": ua_contact, "Accept": "application/json"})
with urllib.request.urlopen(cr_req, timeout=timeout) as resp:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"notice_doi": "", "when": raw_date, "source": "local",
"check_failed": False}
mailto = _OPTS.get("mailto") or ""
url = f"https://api.crossref.org/works/{quote(doi, safe='()/')}"
if mailto:
url += f"?mailto={quote(mailto, safe='@')}"
if _cb_open(url):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
_DOCTOR_PROBES = [
("DOI.org 解析", "https://doi.org/10.3866/PKU.WHXB201112303"),
("Crossref API", "https://api.crossref.org/works?rows=0&mailto=doctor%40cite-holmes"),
("PubMed E-utilities", "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/"
"esearch.fcgi?db=pubmed&retmode=json&retmax=0&term=cite+holmes+doctor"),
("arXiv API", "https://export.arxiv.org/api/query?search_query=all%3Acite&max_results=1"),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# v3.6 --cn 回源：api.crossref.org/works/{doi} 返回同构 CSL(message 字段)。
# 独立主机不计入 doi.org 断路器；失败静默回原路径。
try:
cr_url = f"https://api.crossref.org/works/{quote(doi, safe='()/')}"
cr_req = urllib.request.Request(cr_url, headers={
"User-Agent": ua_contact, "Accept": "application/json"})
with urllib.request.urlopen(cr_req, timeout=timeout) as resp:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"notice_doi": "", "when": raw_date, "source": "local",
"check_failed": False}
mailto = _OPTS.get("mailto") or ""
url = f"https://api.crossref.org/works/{quote(doi, safe='()/')}"
if mailto:
url += f"?mailto={quote(mailto, safe='@')}"
if _cb_open(url):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
ou = None
try:
q = quote(topic, safe="")
ou = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=%7Blimit}"
"&select=display_name,publication_year,doi,primary_location"
+ ("&sort=cited_by_count:desc" if sort == "cited" else
"&sort=publication_date:desc" if sort == "newest" else ""))
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
("PubMed E-utilities", "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/"
"esearch.fcgi?db=pubmed&retmode=json&retmax=0&term=cite+holmes+doctor"),
("arXiv API", "https://export.arxiv.org/api/query?search_query=all%3Acite&max_results=1"),
("OpenAlex", "https://api.openalex.org/works?per-page=1&select=id"),
("Semantic Scholar", "https://api.semanticscholar.org/graph/v1/paper/"
"DOI:10.3866/PKU.WHXB201112303?fields=title"),
("Wayback 存档", "https://archive.org/wayback/available?url=example.com"),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
ou = None
try:
q = quote(topic, safe="")
ou = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=%7Blimit}"
"&select=display_name,publication_year,doi,primary_location"
+ ("&sort=cited_by_count:desc" if sort == "cited" else
"&sort=publication_date:desc" if sort == "newest" else ""))
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if len((title or "").strip()) < 18:
return "", False, ""
q = quote(title.strip(), safe="")
url = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=3"
"&select=display_name,publication_year,doi")
key = _OPTS.get("openalex_key") or ""
if key:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if len((title or "").strip()) < 18:
return "", False, ""
q = quote(title.strip(), safe="")
url = (f"https://api.openalex.org/works?search=%7Bq%7D&per-page=3"
"&select=display_name,publication_year,doi")
key = _OPTS.get("openalex_key") or ""
if key:
Detected: suspicious.exposed_secret_literal