bib-verify

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it checks BibTeX references against academic databases, with ordinary privacy and dependency-installation cautions.

Install in a virtual environment, consider pinning or reviewing dependencies first, and do not run network verification on private, unpublished, or regulated bibliography data unless sending citation metadata to CrossRef, arXiv, and DBLP is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–25
Vulnerability Type: Unpinned and unaudited third-party package installation
Risk Level: Medium

markdown

## Prerequisites

```bash
pip install py-openjudge litellm

text

### Technical Analysis

The skill instructs users or agents to install `py-openjudge` and `litellm` without exact version constraints, package hashes, a lockfile, or an explicit trusted package index. Consequently, package resolution can change between installations and may retrieve newly compromised releases or unsafe transitive dependencies.

Python package installation may execute package build and installation logic on the local system. If an upstream package, maintainer account, release artifact, or resolved transitive dependency is compromised, attacker-controlled code could execute with the privileges of the user running `pip`.

The repository contains no vendored implementation, dependency manifest, integrity metadata, or executable implementation with which to verify the packages or the documented `cookbooks.paper_review` module. This finding does not establish that either named package is currently malicious; it identifies the unsafe and non-reproducible dependency acquisition process.

### Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, a maintainer account, or the package distribution channel.
2. The attacker publishes a malicious version that remains compatible with the unconstrained package names.
3. A user or agent follows the prerequisite instructions and runs `pip install py-openjudge litellm`.
4. `pip` resolves the mutable malicious release or dependency because no approved version or cryptographic hash is enforced.
5. Malicious build, installation, or runtime code executes under the installing user's account.
6. The payload can access resources available to that account and may modify the envir
...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Generate a fully resolved lockfile that also constrains all transitive dependencies.
3. Record cryptographic hashes for every approved distribution and require hash verification during installation, such as with pip install --require-hashes -r requirements.txt.
4. Use an explicitly configured trusted package index or an internally controlled package mirror rather than relying on unrestricted package resolution.
5. Document the provenance and review status of py-openjudge, litellm, and the package that supplies cookbooks.paper_review.
6. Install dependencies in an isolated virtual environment or sandbox under a non-privileged account.
7. Add automated dependency vulnerability and integrity scanning, and review updates before changing pinned versions.
8. Include the executable implementation or an auditable reference to its exact version so its network requests, input handling, and report-generation behavior can be independently reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to verify bibliography entries by querying CrossRef, arXiv, and DBLP, but it does not clearly warn that BibTeX metadata will be transmitted to third-party services. Bibliographies can contain unpublished papers, internal references, author identities, or sensitive research directions, so sending them externally without explicit disclosure can create privacy, confidentiality, or compliance risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The options table states that --language defaults to en, which imposes a specific language unless the user discovers and changes the option. Under the policy, forcing a language without opt-in can be a locale/language policy issue unless clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.