Phy Citation Checker

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 1.0.2

Overview

This citation-checking skill behaves consistently with its stated purpose, but users should know that citation titles and DOIs are queried against external academic databases.

Install only if you are comfortable with bibliography titles and DOIs being sent to CrossRef, Semantic Scholar, and OpenAlex during checks. For embargoed, confidential, or unpublished work, review or redact the .bib file first, or avoid networked verification.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes verification against CrossRef, Semantic Scholar, and OpenAlex but does not clearly disclose that citation metadata from users' .bib files will be transmitted to third-party services. Bibliographies can contain unpublished manuscripts, private reading lists, or sensitive research topics, so omission of this data-sharing warning can lead users to expose information unexpectedly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires reading local bibliography files and making outbound requests to CrossRef, Semantic Scholar, and OpenAlex, but it does not declare any explicit tool scope or permissions. This creates a trust and governance gap: an agent or user may invoke the skill without clear visibility that local file contents can be transmitted externally, increasing the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description and usage text do not clearly warn users that citation metadata from local files will be sent to third-party services for verification. Even if the data seems low sensitivity, bibliographies can reveal unpublished work, collaborators, internal project names, or embargoed research directions, so silent transmission to external services poses a privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends citation metadata such as titles and DOI values to third-party services without an explicit runtime warning or consent step. In many environments, bibliographies may reveal unpublished work, internal project topics, or sensitive research directions, so undisclosed external transmission creates a real privacy and compliance risk even though the behavior is core to the tool's purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This request transmits a user-supplied DOI to CrossRef. Although HTTPS is used and the destination is expected for the feature, the transmission can still disclose sensitive manuscript references or research intent to an external service, which matters in prepublication or confidential contexts.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 242)May include surrounding context.

python

try:
        # If DOI is provided, verify directly
        if entry.doi:
            url = f"https://api.crossref.org/works/{entry.doi}"
            resp = requests.get(url, headers=HEADERS, timeout=10)
            if resp.status_code == 200:
                data = resp.json()["message"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This request sends the full citation title to CrossRef for search. Titles of draft papers, internal reports, or confidential literature reviews may themselves be sensitive, so automatic transmission to a third party without a prominent warning is a legitimate information disclosure issue.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 272)May include surrounding context.

python

for search_title in search_titles:
            query = urllib.parse.quote(search_title)
            url = f"https://api.crossref.org/works?query.title={query}&rows=5"
            resp = requests.get(url, headers=HEADERS, timeout=15)
            if resp.status_code == 200:
                items = resp.json().get("message", {}).get("items", [])

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The Semantic Scholar query sends the citation title to an external API, exposing user data outside the local environment. In the context of academic-report verification, this is expected functionality, but it still creates privacy, confidentiality, and policy-compliance risk when processing unpublished or restricted references.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 307)May include surrounding context.

python

) -> Optional[dict]:
    """Search Semantic Scholar. Covers 200M+ papers with author disambiguation."""
    query = urllib.parse.quote(entry.title)
    url = f"https://api.semanticscholar.org/graph/v1/paper/search?query={query}&limit=3&fields=title,authors,year,externalIds"

    for attempt in range(2):
        try:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The OpenAlex lookup transmits citation titles to a third-party service. Because bibliographic content can reveal confidential research topics, grant work, or not-yet-published sources, this is a real external data exposure concern even though the code is not overtly malicious.

Content

Scanner excerpt · scripts/citation_checker.py (reported line 359)May include surrounding context.

python

for search_title in search_titles:
        try:
            query = urllib.parse.quote(search_title)
            url = f"https://api.openalex.org/works?filter=title.search:{query}&per_page=5"
            resp = requests.get(
                url,
                headers={**HEADERS, "Accept": "application/json"},

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This is a code file, so SQP-2 applies to safety-relevant operations such as network calls that transmit data. The file's comments mention 'API calls' and rate limiting, but the executable path in main() runs those tests by default without a visible runtime disclosure that citation data will be sent to external services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.