Bibverify

Verify, repair, explain, and generate BibTeX references with Bibverify's DOI-first CLI and MCP tools.

Security Scan

The skill's requirements and runtime instructions are consistent with a BibTeX verification/generation tool; nothing requested is disproportionate to its stated purpose, but the skill is instruction-only and refers to installing a PyPI package from an unknown source, which lowers confidence.

Purpose & Capability

Name and description match the declared requirement (the bibverify binary and MCP tools). Required binary 'bibverify' is directly related to the stated purpose; no unrelated binaries, env vars, or config paths are requested.

Instruction Scope

SKILL.md confines itself to BibTeX tasks: calling MCP tools (doi_to_bibtex, rank_lookup_sources, explain_update_diff, verify_bib_file) or falling back to the 'bibverify' CLI. It explicitly warns about backups and not overwriting files and to avoid exposing API keys. It does not instruct reading unrelated system files or env vars.

Install Mechanism

The skill is instruction-only (no install spec). SKILL.md suggests installing 'bibverify' via 'pip install -U bibverify' if the binary is missing — this is a reasonable fallback but introduces standard PyPI risks (pulling code from a package whose provenance is not provided). No direct install URLs or downloads are embedded in the skill.

Credentials

No environment variables, credentials, or config paths are required. The example config includes a user email field, but no secret or API key is demanded by the skill itself. This is proportionate to the functionality described.

Persistence & Privilege

The skill is not marked 'always: true' and does not request any persistent system-wide privileges or to modify other skills. It's a standard, on-demand skill with no elevated installation behavior declared.

Assessment

This skill appears coherent and does what it says: it expects a 'bibverify' CLI or MCP tools and gives guidance on using them. Before installing or running: (1) confirm where the 'bibverify' binary comes from — the SKILL.md suggests PyPI but the skill metadata has no source or homepage, so verify the package and author on PyPI; (2) prefer running in a sandbox or virtualenv when using 'pip install'; (3) back up .bib files (the skill also recommends timestamped backups) and review any changes before accepting them; (4) if you plan to use an MCP server, check what network endpoints and credentials that server requires — the skill does not declare or request keys but the server could; (5) if you need higher assurance, ask the skill author/publisher for the source repo or a trusted release location before installing.

Use this skill when the user asks to verify a .bib file, repair BibTeX metadata, generate BibTeX from a DOI, explain why a reference lookup source was chosen, or compare original vs updated BibTeX fields.

Preferred Path

If the Bibverify MCP server is available, call its tools directly:

• doi_to_bibtex: Convert a DOI, DOI URL, or DOI-prefixed value to BibTeX.
• rank_lookup_sources: Explain the effective lookup order for a title and optional BibTeX entry.
• explain_update_diff: Compare original and updated BibTeX-like entry objects.
• verify_bib_file: Verify a .bib file through a Bibverify config file.

Prefer doi_to_bibtex for one DOI. Prefer verify_bib_file for project-level reference checks.

CLI Fallback

If MCP is not configured but the bibverify command is available:

bibverify --doi 10.1038/nature12373 --key example2013
bibverify config.json

For first-time setup, tell the user to install Bibverify from PyPI and create a minimal config:

pip install -U bibverify

{
  "language": "EN",
  "bib_file": "references.bib",
  "user_info": {
    "email": "[e-mail]",
    "app_name": "Bibverify"
  }
}

Safety

• Do not silently overwrite the source .bib file.
• Tell the user that Bibverify writes timestamped backup, updated, and problem-entry files using the input .bib filename stem.
• Do not invent missing bibliographic metadata. Use Bibverify results and explain uncertainty when sources disagree.
• Do not expose API keys or local config secrets in the answer.

Response Style

Summarize what Bibverify checked, which sources were used or preferred, which entries changed, and where generated files were written. For user-facing explanations, focus on DOI-first lookup, dynamic source ranking, field differences, and remaining entries that need manual review.