Back to skill

Security audit

lit-review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a literature-review helper that openly retrieves public academic results and writes review files, with privacy and dependency-hygiene notes users should understand before use.

Install only if you are comfortable sending research topics and retrieved paper metadata to public academic services, and do not enable LLM polishing for confidential work unless you trust the configured LLM provider. Prefer a locked or updated dependency set before using it in a sensitive environment.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger keywords are broad enough to overlap with ordinary user requests such as asking to search papers or write a review, which can cause the skill to activate unexpectedly. In a skill that performs network retrieval and generates output files, unintended activation increases the chance of surprise external requests or unintended content generation without clear user consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README describes automatic retrieval from external academic sources and saving output to files, but it does not clearly warn users that the skill will access the network and may write local files. This can lead to users unintentionally disclosing queries to third parties or creating files on disk without informed consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code transmits user-supplied research queries to third-party services (Semantic Scholar, and elsewhere in the workflow also arXiv/CrossRef) without explicit notice, consent, or data-handling disclosure. This can leak sensitive research topics, internal project names, or confidential terms to external providers, which is a real privacy/security issue even though it is expected functionality for a literature search tool.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
When LLM writing is enabled, the skill sends the user-supplied topic and selected paper metadata/abstract snippets to an external LLM provider without an explicit consent warning at the point of transmission. In this context the data is usually academic rather than highly sensitive, so risk is moderate, but queries or abstracts could still contain proprietary research interests or confidential material.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The activation criteria are very broad and match common requests like searching papers, writing reviews, or identifying trends. This can cause the skill to trigger unexpectedly in normal conversations, leading to unanticipated network access and data transmission to external academic APIs or optional LLM services.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description does not clearly warn users that their research topic, keywords, and potentially paper abstracts may be sent to third-party APIs and optionally to an LLM endpoint. This creates a transparency and privacy issue because users may provide sensitive research plans or proprietary topics without realizing that external transmission will occur.

External Transmission

Medium
Category
Data Exfiltration
Content
def search_semantic_scholar(self, keywords: str, years: int, limit: int = 50) -> List[Dict]:
        """从Semantic Scholar检索文献"""
        print("\n📚 正在检索 Semantic Scholar...")
        url = "https://api.semanticscholar.org/graph/v1/paper/search"
        current_year = datetime.now().year
        
        params = {
Confidence
96% confidence
Finding
The skill sends user-derived search terms to Semantic Scholar over the network, creating external data disclosure to a third party. In context, this is core functionality rather than malicious behavior, but it becomes dangerous when users may enter proprietary research topics, unreleased product names, or sensitive investigation themes.

External Transmission

Medium
Category
Data Exfiltration
Content
def search_crossref(self, keywords: str, years: int, limit: int = 30) -> List[Dict]:
        """从CrossRef检索文献"""
        print("\n📑 正在检索 CrossRef...")
        url = "https://api.crossref.org/works"
        current_year = datetime.now().year
        
        params = {
Confidence
95% confidence
Finding
The CrossRef integration also transmits user-influenced queries to an external service, which can expose sensitive research intent or confidential keywords outside the local environment. While expected for a literature review tool, the lack of explicit privacy signaling and control makes it a genuine external-transmission risk.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    api_base = config.get("llm_api_base")
    try:
        resp = requests.post(f"{api_base}/chat/completions", headers=headers, json=data, timeout=60)
        resp.raise_for_status()
        result = resp.json()
        content = result["choices"][0]["message"]["content"]
Confidence
87% confidence
Finding
This line performs external transmission of user topic and paper-derived content to a configurable LLM endpoint. In a skill context, outbound transfer to a third party is security-relevant because it can disclose research intent, collected metadata, and possibly confidential abstracts if users supply sensitive topics or private corpora later.

External Transmission

Medium
Category
Data Exfiltration
Content
- 若用户未提供,使用配置文件中的默认值(默认5年�?0篇)
- 自动生成英文同义词和字段变体

### 2. 文献检�?- 并发调用以下API(优先使用Semantic Scholar,返回结果快且丰富)�?  - **Semantic Scholar API**:`https://api.semanticscholar.org/graph/v1/paper/search`
  - **arXiv API**:`http://export.arxiv.org/api/query`
  - **CrossRef API**:`https://api.crossref.org/works`
- 检索参数:关键词、出版年份范围、按相关性排序、每页最�?00�?- 合并去重(基于DOI或标题相似度�?
Confidence
95% confidence
Finding
The skill explicitly sends user-supplied research queries to Semantic Scholar over the network. In context, this is expected functionality, but it is still a real external transmission risk because user topics may contain sensitive or proprietary information and the skill does not indicate strong consent or minimization controls.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. 文献检�?- 并发调用以下API(优先使用Semantic Scholar,返回结果快且丰富)�?  - **Semantic Scholar API**:`https://api.semanticscholar.org/graph/v1/paper/search`
  - **arXiv API**:`http://export.arxiv.org/api/query`
  - **CrossRef API**:`https://api.crossref.org/works`
- 检索参数:关键词、出版年份范围、按相关性排序、每页最�?00�?- 合并去重(基于DOI或标题相似度�?
### 3. 相关性筛选(本地�?- 对摘要和标题进行关键词匹配或TF-IDF向量化,计算与用户关键词的余弦相似度
- 按相似度降序排序,结合引用数加权,保留前 `max_papers` �?- �?`human_review_papers = true`,则生成候选列表并询问用户是否采纳或手动剔�?
Confidence
95% confidence
Finding
The skill sends query data to CrossRef and also references arXiv in the same retrieval stage, meaning user research interests are disclosed to additional third-party services. The danger is amplified by concurrent querying across multiple providers without an explicit user-facing warning or consent step.

External Transmission

Medium
Category
Data Exfiltration
Content
|------|------|--------|------|
| use_llm_for_writing | bool | false | 是否使用大模型润色综�?|
| llm_model | str | deepseek-chat | 大模型名�?|
| llm_api_base | str | https://api.deepseek.com/v1 | 大模型API端点 |
| llm_api_key | str | - | 大模型API密钥(需配置�?|
| output_format | str | markdown | 输出格式(markdown/docx/txt�?|
| human_review_papers | bool | false | 是否请求用户确认文献列表 |
Confidence
97% confidence
Finding
Optional LLM polishing mode sends locally generated draft content and paper abstracts to a third-party LLM endpoint. Because abstracts, synthesis text, and the user's topic may encode confidential research directions, transmitting them to an external model service materially increases privacy, compliance, and data handling risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 文献综述生成器依赖
requests>=2.28.0
scikit-learn>=1.0.0
numpy>=1.21.0
Confidence
93% confidence
Finding
Using a lower-bound specifier for requests allows installation of different versions over time, reducing build reproducibility and potentially pulling in versions with known vulnerabilities or breaking changes. In this file, that risk is amplified because the minimum version aligns with a version called out separately as vulnerable.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 文献综述生成器依赖
requests>=2.28.0
scikit-learn>=1.0.0
numpy>=1.21.0

# 可选:高级主题聚类
Confidence
92% confidence
Finding
Using scikit-learn>=1.0.0 leaves dependency resolution open-ended, which harms reproducibility and can permit installation of insecure or incompatible versions depending on environment and mirror state. Because the minimum permitted version is separately identified as vulnerable, the practical exposure is more significant than a generic pinning issue.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 文献综述生成器依赖
requests>=2.28.0
scikit-learn>=1.0.0
numpy>=1.21.0

# 可选:高级主题聚类
sentence-transformers>=2.0.0
Confidence
88% confidence
Finding
The unpinned numpy dependency permits version drift across environments, which can introduce security regressions or unexpected behavior. While the cited known issue for the minimum version is lower impact, the lack of pinning still weakens supply-chain hygiene.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.21.0

# 可选:高级主题聚类
sentence-transformers>=2.0.0
bertopic>=0.12.0

# 可选:DOCX格式输出
Confidence
84% confidence
Finding
sentence-transformers is specified with only a minimum version, so installations are not reproducible and may vary across time and environments. This creates supply-chain uncertainty even though no specific vulnerable version is identified in the provided findings.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 可选:高级主题聚类
sentence-transformers>=2.0.0
bertopic>=0.12.0

# 可选:DOCX格式输出
python-docx>=0.8.11
Confidence
84% confidence
Finding
bertopic is not pinned to an exact safe version, which can lead to non-deterministic builds and accidental introduction of vulnerable or incompatible releases. This is primarily a supply-chain hardening weakness rather than an immediate exploit by itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
bertopic>=0.12.0

# 可选:DOCX格式输出
python-docx>=0.8.11
Confidence
84% confidence
Finding
python-docx is specified as a floating minimum version, so build outcomes can change over time without code changes. This weakens reproducibility and increases exposure to future dependency issues, even if no specific CVE is cited here.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The dependency specification permits requests 2.28.0, which is identified as having multiple advisories including credential leakage and request verification flaws. If that version is installed, network operations performed by the skill could expose secrets or weaken transport/security assumptions.

Known Vulnerable Dependency: scikit-learn==1.0.0 — 3 advisory(ies): CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service); CVE-2024-5206 (A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVec)

High
Category
Supply Chain
Confidence
95% confidence
Finding
The file allows scikit-learn 1.0.0, which is flagged for sensitive data leakage and denial-of-service issues. In a literature-review or text-processing skill, ML/vectorization components may process user-provided or proprietary text, so leakage or resource exhaustion could materially affect confidentiality and availability.

Known Vulnerable Dependency: numpy==1.21.0 — 1 advisory(ies): CVE-2021-34141 (Incorrect Comparison in NumPy)

Low
Category
Supply Chain
Confidence
86% confidence
Finding
The dependency range allows numpy 1.21.0, which is cited with a known vulnerability. The direct security impact appears lower than the other flagged libraries, but permitting a known-vulnerable baseline is still poor dependency hygiene and can become more dangerous depending on how array comparisons influence trust or validation logic elsewhere in the skill.

Static analysis

No suspicious patterns detected.