ref-manager

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 9:48 AM UTC
• Version: 1.0.1

Overview

This skill does what it claims: it reads user-provided citation sources, checks DOI metadata online, and writes EndNote/Excel outputs, with no hidden persistence or unrelated data handling found.

Install only if you are comfortable letting the skill read the PDF files or folders you explicitly provide and fetch the web pages/DOIs involved. Prefer reviewing or pinning dependencies before repeated use, and avoid giving broad private folders or sensitive internal URLs unless you intend them to be processed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to read local files and access network resources, but it declares no permissions or trust boundary information. That mismatch can lead to overbroad execution in environments where users or reviewers are not clearly informed that local PDF paths, folders, and external URLs will be accessed, increasing the risk of unintended data exposure or SSRF-like behavior if arbitrary paths/URLs are accepted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28
beautifulsoup4>=4.11
pypdf>=3.9
openpyxl>=3.1

• Confidence: 94% confidence
• Finding: The dependency is specified with only a minimum version bound, which permits installation of many different future versions and makes builds non-reproducible. In a skill that fetches web content and processes external files, this increases supply-chain and reliability risk because a later incompatible or compromised release could be pulled in unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28
beautifulsoup4>=4.11
pypdf>=3.9
openpyxl>=3.1

• Confidence: 94% confidence
• Finding: Using an unpinned version for beautifulsoup4 allows uncontrolled upgrades at install time, reducing reproducibility and increasing exposure to supply-chain or compatibility issues. Because this skill parses untrusted web pages, dependency predictability matters for both security review and operational safety.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28
beautifulsoup4>=4.11
pypdf>=3.9
openpyxl>=3.1

• Confidence: 95% confidence
• Finding: The unpinned pypdf requirement allows arbitrary newer releases to be installed, which can introduce unreviewed behavior changes or newly introduced flaws. Since the skill processes PDFs from users or folders of PDFs, dependency control is especially important to limit parser-related risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28
beautifulsoup4>=4.11
pypdf>=3.9
openpyxl>=3.1

• Confidence: 93% confidence
• Finding: An open-ended version constraint for openpyxl means future releases may be installed without validation, undermining reproducibility and increasing supply-chain risk. Because the skill generates Excel reconciliation sheets, this dependency is part of the output-processing path and should be tightly controlled.

Known Vulnerable Dependency: requests==2.28 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The finding indicates that requests 2.28 is associated with multiple published advisories, including credential leakage via malicious URLs and request verification issues. This skill explicitly retrieves remote web content, so a vulnerable HTTP client is materially more dangerous here because attacker-controlled URLs or redirects may be part of normal operation.

Known Vulnerable Dependency: pypdf==3.9 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The reported pypdf 3.9 advisories include denial-of-service style issues such as infinite loops or extreme runtimes when parsing crafted PDFs. This is particularly relevant because the skill is designed to extract references from PDFs and folders of PDFs, so processing attacker-supplied or malformed documents is a core feature and could hang the agent or exhaust resources.

Static analysis

No suspicious patterns detected.