Security audit

Citation Formatter

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a citation formatter, but its documentation materially overstates what the included code can do.

Review this skill carefully before installing. It does not show malicious behavior, but it should not be trusted for publication-critical citation conversion beyond simple AMA formatting unless the documentation and implementation are corrected and outputs are manually checked.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill metadata and examples substantially overstate capabilities, claiming broad style support, bibliography generation, accuracy assurance, and reference-manager integration that are not evidenced by the described behavior. This can cause users or downstream agents to trust the tool for publication-critical tasks it cannot reliably perform, leading to silent data quality failures, incorrect citations, or misuse in automated workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata advertises broad multi-style citation conversion, bibliography generation, and reference-manager integration, but the implementation only formats citations into AMA style. This discrepancy can mislead users or upstream agents into relying on unsupported behavior, causing incorrect manuscript references, workflow failures, or silent data-quality issues in publication pipelines.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module documentation explicitly states the tool converts to AMA style only, which conflicts with the broader skill description promising conversion among APA, MLA, Vancouver, Chicago, and more. In an agent ecosystem, this kind of contract mismatch is dangerous because orchestrators may invoke the skill under false assumptions, leading to incorrect outputs being treated as valid without obvious failure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The summary 'Use when working with citation formatter' is overly broad and can cause the skill to be invoked in situations beyond narrowly scoped citation-formatting tasks. Overbroad activation increases the chance that irrelevant or lower-priority instructions are introduced into unrelated workflows, which can expand the attack surface for prompt injection or unintended tool use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This is a markdown file, so SQP-2 applies to missing user-facing warnings in the description. The examples show output generation to formatted/ and formatted.docx, which implies file creation/writes, but the skill documentation does not explicitly warn users that running it will produce or overwrite files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.