GB/T 7714—2025 参考文献著录检查

• Outcome: Pass
• Latest audit: Oct 9, 2026 · 1:35 AM UTC
• Version: 4.0.5

Overview

The skill does what it claims: it checks reference formatting and verifies citations through disclosed public bibliography APIs, with privacy considerations for sensitive manuscripts.

Installers should be comfortable with the skill sending citation metadata to Crossref and sometimes OpenAlex during verification. For confidential drafts, unpublished manuscripts, grant materials, or embargoed reference lists, use a manual/offline review path or avoid live verification unless disclosure to those public APIs is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs file reads, file writes, and outbound network access, but it does not declare any explicit tool scope or permissions. This creates an authorization ambiguity where a host may grant broader capabilities than intended, increasing the risk of unintended document access, overwriting files, or sending user-provided references and document contents to external services without clear policy gating.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This instruction explicitly directs outbound HTTP requests to Crossref. Because the skill processes pasted references and uploaded papers, those requests can transmit DOI values, titles, and potentially full bibliographic strings derived from user documents to an external service, creating a real data egress path that may expose sensitive research content or unpublished manuscripts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

| 环境 | 取数手段 |
|---|---|
| 有 Python、可运行本地文件（WorkBuddy 等） | **A. 脚本**：`python scripts/crossref_verify.py …` |
| 无 Python / 不能执行脚本（**ima 等纯对话环境**） | **B. 直连**：`GET https://api.crossref.org/works/{DOI}` |

**两条路径取数结果与判定标准完全一致，不存在"哪个更可信"的差别。**
脚本内部做的也不过是向同样的 URL 发 HTTP GET，直连只是把这一步手工做出来。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The listed Crossref query endpoint for title-based matching sends user-derived citation content off-platform. In a reference-checking skill, bibliographic data may come from unpublished drafts, grant proposals, or confidential manuscripts, so this external lookup can leak nonpublic work-in-progress metadata.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

两个必须记住的 URL（B 段，没脚本时直接用）：

text

GET https://api.crossref.org/works/{DOI}                    # 有 DOI → 直查（最优先）
GET https://api.crossref.org/works?query.title={题名}&rows=5  # 无 DOI → 文本匹配
GET https://api.openalex.org/works/doi:{DOI}                # 交叉验证

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The bibliographic and title query patterns to Crossref create a direct content exfiltration channel for user-supplied references. Text-match lookups are riskier than DOI resolution because they may transmit full citation strings, increasing disclosure of authorship, topics, venues, and other details from private documents.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

text

GET https://api.crossref.org/works/{DOI}                    # 有 DOI → 直查（最优先）
GET https://api.crossref.org/works?query.title={题名}&rows=5  # 无 DOI → 文本匹配
GET https://api.openalex.org/works/doi:{DOI}                # 交叉验证

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This adds outbound requests to OpenAlex, a second third-party service, further increasing the data exposure surface. Since the skill mandates this cross-validation in some cases, user citation data may be shared with multiple external providers without a clearly declared permission boundary or manifest-level disclosure.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

text

GET https://api.crossref.org/works/{DOI}                    # 有 DOI → 直查（最优先）
GET https://api.crossref.org/works?query.title={题名}&rows=5  # 无 DOI → 文本匹配
GET https://api.openalex.org/works/doi:{DOI}                # 交叉验证

判定口诀：能跑脚本就跑脚本；跑不了脚本就直接发 HTTP 请求。两条路都不通时，才转入人工核查清单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The DOI direct-lookup flow is a real external transmission path. While DOI-only requests are lower risk than full-text citation matching, they still disclose what works a user is validating and may reveal research interests, manuscript contents, or review targets to a third party.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

B1. DOI 直查（最优先——DOI 能解析即证明记录已在 Crossref 注册）：

text

GET https://api.crossref.org/works/{DOI}
Header: User-Agent: GB7714-Checker/4.0.4 (mailto:<你的邮箱>)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The query.bibliographic endpoint sends complete citation text externally, which is the highest-risk form of lookup described in the skill. If the input comes from confidential drafts or embargoed papers, these requests can expose unpublished references and research direction to external infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

B2. 无 DOI 的英文文献——引文文本匹配（必须双字段检索，不可只用其一）：

text

GET https://api.crossref.org/works?query.bibliographic={著录文本}&rows=5
GET https://api.crossref.org/works?query.title={题名}&rows=5
    &select=DOI,title,author,container-title,issued,volume,issue,page,type,score

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The query.title lookup still transmits user-derived reference metadata to Crossref and may disclose sensitive unpublished paper titles. Although narrower than query.bibliographic, it remains an external egress path that should be governed and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

text

GET https://api.crossref.org/works?query.bibliographic={著录文本}&rows=5
GET https://api.crossref.org/works?query.title={题名}&rows=5
    &select=DOI,title,author,container-title,issued,volume,issue,page,type,score

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill requires OpenAlex DOI-based verification, creating additional third-party disclosure beyond the primary Crossref workflow. Mandatory multi-service verification increases exposure and operational risk if users or administrators expected a single external dependency.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

B3. 交叉验证（强制触发）：

text

GET https://api.openalex.org/works/doi:{DOI}                     # 按 DOI
GET https://api.openalex.org/works?filter=title.search:{题名}     # 按题名

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The OpenAlex title-search flow sends user-supplied titles externally, which can leak unpublished or sensitive research topics. Because this is described as a required verification path, the skill encourages routine third-party transmission without a clearly bounded trust model.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

text

GET https://api.openalex.org/works/doi:{DOI}                     # 按 DOI
GET https://api.openalex.org/works?filter=title.search:{题名}     # 按题名

返回字段对照（直连结果与脚本输出一一对应，判定时按同一套字段解读）：

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The OpenAlex cross-validation requirement institutionalizes repeated outbound transmission of citation data to a second external service. In the context of uploaded papers and reference lists, that increases privacy and compliance risk, especially for confidential, embargoed, or proprietary documents.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

### 3.4 交叉验证

OpenAlex（`https://api.openalex.org/works/doi:{doi}`，无需 key，CC0；按题名检索用 `?filter=title.search:{题名}`）在两种情况下**必须**执行：

1. **Crossref 查不到**——两者均无结果时，方可标记为"疑似不存在"。
2. **字段出现反常**——作者署名形态可疑（西文姓名缩写与姓名不匹配、中国人名写成西式形态）、作者数与原文不符、卷期号缺失或与原文不符。此时用 OpenAlex 比对；**两库矛盾时不得采信任一库**，列入人工清单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 201)May include surrounding context.

③ OpenAlex 交叉验证（强制触发场景见第五节）：

text

GET https://api.openalex.org/works/doi:{DOI}
GET https://api.openalex.org/works?filter=title.search:{题名}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 202)May include surrounding context.

③ OpenAlex 交叉验证（强制触发场景见第五节）：

text

GET https://api.openalex.org/works/doi:{DOI}
GET https://api.openalex.org/works?filter=title.search:{题名}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 299)May include surrounding context.

③ OpenAlex 交叉验证（强制触发场景见第五节）：

text

GET https://api.openalex.org/works/doi:{DOI}
GET https://api.openalex.org/works?filter=title.search:{题名}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 184)May include surrounding context.

md

import urllib.parse
import urllib.request

API = "https://api.crossref.org/works"
PLACEHOLDER_MAILTO = "[e-mail]"
# Retrieval queries travel in the URL; keep them well under the server/proxy
# limit so an over-long citation cannot turn into an opaque HTTP 414.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 191)May include surrounding context.

md

import urllib.parse
import urllib.request

API = "https://api.crossref.org/works"
PLACEHOLDER_MAILTO = "[e-mail]"
# Retrieval queries travel in the URL; keep them well under the server/proxy
# limit so an over-long citation cannot turn into an opaque HTTP 414.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/verification-sources.md (reported line 192)May include surrounding context.

md

import urllib.parse
import urllib.request

API = "https://api.crossref.org/works"
PLACEHOLDER_MAILTO = "[e-mail]"
# Retrieval queries travel in the URL; keep them well under the server/proxy
# limit so an over-long citation cannot turn into an opaque HTTP 414.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crossref_verify.py (reported line 58)May include surrounding context.

python

import urllib.parse
import urllib.request

API = "https://api.crossref.org/works"
PLACEHOLDER_MAILTO = "[e-mail]"
# Retrieval queries travel in the URL; keep them well under the server/proxy
# limit so an over-long citation cannot turn into an opaque HTTP 414.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crossref_verify.py (reported line 197)May include surrounding context.

python

import urllib.parse
import urllib.request

API = "https://api.crossref.org/works"
PLACEHOLDER_MAILTO = "[e-mail]"
# Retrieval queries travel in the URL; keep them well under the server/proxy
# limit so an over-long citation cannot turn into an opaque HTTP 414.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill expands its external dependency set to OpenAlex even though the described live verification scope is Crossref-based. This mismatch matters because it can send user-supplied citation data to an additional third party that operators or users may not expect, weakening transparency and potentially violating deployment restrictions or data handling assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest says the skill is for compliance checking and authenticity verification, and explicitly says it is not for retrieval or citation-style conversion. The implementation also instructs the agent to export results as Word or PDF using other skills, which adds a document-generation/export capability not described as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This file is a code file, so natural-language policy violations in docstrings and help text are in scope. The introductory documentation is entirely Chinese and does not offer an alternative language or explain a region-specific constraint, which can violate a language/locale policy that requires user choice or explicit justification.

Content

No source excerpt is available for this finding.