Security audit

Bibtex to Literature Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed document-generation helper for turning user-provided reference files into validated Word literature reviews.

Install this if you want an agent to process reference files and create Word literature-review DOCX outputs. Provide only source files you intend the agent to read, choose explicit output paths, and manually review the generated bibliography and DOCX for academic accuracy.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs use of local scripts, shell commands, and file reads/writes, but it declares no explicit permissions or guardrails for those capabilities. This creates an authorization and transparency gap: an agent may execute code and modify files without the user or platform having a clear, enforceable permission boundary.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill enables implicit invocation while providing only a broad default prompt and no constrained trigger conditions, which increases the chance the agent will auto-select this skill for loosely related document or citation tasks. Because the skill is designed to parse user-supplied files and generate Word documents, unintended invocation could expose sensitive file contents to unnecessary processing or cause the agent to take higher-impact actions than the user explicitly requested.

Static analysis

No suspicious patterns detected.