Bibtex to Literature Review

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.0

Overview

The core document-generation skill is mostly coherent, but the package includes unrelated agent memory-retrieval instructions that users should review before installing.

Before installing, remove the AGENTS.md memory-context block or confirm it will not be loaded by your agent. Treat DOCX validation as local file processing only, and avoid running the validator on untrusted DOCX files until archive size/count limits are added. The bibliography and DOCX scripts otherwise appear purpose-aligned and should be used with explicit input and output paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: AGENTS.md:1

Finding

Agent Context Redirected to Unrelated Persistent-Memory Tools

Content

View full analysis

# Memory Context # [bibtex-literature-review] recent context, 2026-05-15 4:11pm GMT+8 Legend: 🎯session 🔴bugfix 🟣feature 🔄refactor ✅change 🔵discovery ⚖️decision 🚨security_alert 🔐security_note Format: ID TIME TYPE TITLE Fetch details: get_observations([IDs]) | Search: mem-search skill Stats: 11 obs (5,208t read) | 126,590t work | 96% savings ### May 15, 2026 1376 3:48p 🔵 BibTeX literature review skill package structure and quality reviewed 1377 " 🔵 Complete codebase exploration of bibtex-literature-review skill scripts 1378 " ✅ Self-check regression test PASS - full pipeline verified 1380 " 🟣 Auto-filter to cited-only references for Markdown converter 1381 " 🔴 Fixed body_east_asia_font vs east_asia_font naming inconsistency 1379 3:49p 🔵 Style configuration naming inconsistency found between spec doc and build code 1382 4:00p 🟣 Detailed style requirements and capitalization rules for all 7 bibliography styles 1383 4:01p ✅ Zotero export recommendation added to input-formats.md 1384 " 🔴 review-json-spec.md corrected body_east_asia_font → east_asia_font 1385 " ✅ Workflow updated with Zotero recommendation and multimodal inspection guidance 1386 4:02p 🟣 End-to-end test confirms auto-filter and renumbering works correctly Access 127k tokens of past work via get_observations([IDs]) or mem-search skill. ``` ### Technical Analysis `AGENTS.md` is agent-control content that may be loaded automatically when an agent operates within the project directory. The file embeds historical session metadata and directs the agent to invoke `get_observations` or a `mem-search` Skill to retrieve approximately 127,000 tokens of prior work. Persistent-memory retrieval is unrelated to the declared fun ...[truncated 1765 chars]

Remediation

View remediation

` block from the distributed package. 2. Do not package generated memory snapshots, session histories, observation identifiers, or instructions to retrieve persistent memory. 3. Restrict `AGENTS.md` to static, repository-specific development guidance required to operate or maintain the Skill. 4. Require explicit user authorization before accessing any persistent-memory or history-search tool. 5. Add a release check that rejects agent instruction files containing memory-tool directives such as `get_observations`, `mem-search`, or equivalent APIs. 6. Rebuild the package from a clean source tree and verify that no generated agent-context files are included. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_docx_crossrefs.py:31

Finding

Unbounded Extraction of Attacker-Supplied DOCX Archives

Content

View full analysis

tuple[list[str], dict[str, int]]: with tempfile.TemporaryDirectory() as tmp: work = Path(tmp) unzip_docx(path, work) document_path = work / "word" / "document.xml" if not document_path.exists(): return [f"{path} does not contain word/document.xml"], {} parser = etree.XMLParser(remove_blank_text=False) root = etree.parse(str(document_path), parser).getroot() ``` ### Technical Analysis The validator accepts a caller-selected DOCX file and passes it directly to `zipfile.ZipFile.extractall()`. It does not validate: - The number of archive members. - Individual uncompressed member sizes. - Total uncompressed archive size. - Compression ratios. - Duplicate or encrypted entries. - Whether extraction of every DOCX member is necessary. A DOCX is a ZIP archive. An attacker can therefore provide a highly compressed archive whose extracted contents consume substantially more storage than the original file. Extraction occurs before `word/document.xml` is inspected, allowing resource exhaustion even when the archive is not a valid Word document. The builder contains a similar extraction helper, but its normal flow extracts a DOCX that the builder generated itself. The confirmed attacker-controlled path is the standalone validator documented for use with arbitrary DOCX inputs. ### Attack Path 1. An attacker supplies a crafted file with a `.docx` extension. 2. The user or agent follows the documented workflow and runs: ```bash python scripts/validate_docx_crossrefs.py malicious.do ...[truncated 954 chars]

Remediation

View remediation

MAX_DOCUMENT_XML_SIZE: raise ValueError("document.xml exceeds the permitted size") with zf.open(info) as source: xml = source.read(MAX_DOCUMENT_XML_SIZE + 1) ``` 2. Before processing, iterate over `ZipFile.infolist()` and enforce: - A maximum archive-member count. - A maximum size for each uncompressed member. - A maximum cumulative uncompressed size. - A reasonable maximum compression ratio. - Rejection of encrypted or duplicate entries where unsupported. 3. If extraction remains necessary, normalize every member path and verify that its resolved destination remains inside the temporary directory before writing it. 4. Reject absolute paths, parent-directory components, unsupported member types, and malformed archive names. 5. Configure time, memory, and temporary-storage limits around validation in automated environments. 6. Add regression tests using oversized, high-compression, excessive-member, malformed, and duplicate-entry DOCX archives. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a broad end-to-end literature review and Word citation generation capability across many input formats and citation styles. The supplied code only parses BibTeX, extracts fields, formats a rough GB/T reference string, filters records, and emits JSON. This is related to bibliography preprocessing, but it is only a small subset of the declared functionality. There is no Word automation, .docx generation, review writing, OOXML handling, REF citation insertion, or support for the other listed source formats and styles. Therefore the declared description materially overstates and misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description substantially overstates the skill’s capabilities. The code’s actual scope is narrower: it builds a DOCX from an already-structured JSON object containing paragraphs and references, then post-processes OOXML to add bookmark-based REF citations and numbered bibliography formatting. Parts of the description are accurate—such as generating .docx output, using REF/bookmark fields instead of HYPERLINK fields, supporting superscript citation rendering, and manipulating OOXML numbering/update behavior. However, the major declared functionality around parsing many literature source formats and formatting bibliographies into multiple named citation styles is not implemented in this chunk. Because those are central claimed capabilities rather than incidental details, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description describes a full literature-review-to-Word generation pipeline with multi-format bibliography ingestion, citation formatting, .docx output, and Word-specific OOXML/REF behavior. The actual code is much narrower: it reads Markdown text, splits it into paragraphs, detects bracketed citations like [cite:@key] or numeric ranges, maps them to indices from a references JSON list, optionally removes unused references, and emits a JSON object containing title, references, and paragraph parts. This is a preparatory conversion utility, not a Word document builder or bibliography formatter. While it is loosely related to literature review processing, the primary purpose and capabilities are materially different and substantially narrower than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is clearly focused on source-format ingestion and normalization to JSON plus bibliography-string formatting. That partially aligns with the input-format and citation-style portions of the description. However, the declared purpose emphasizes end-to-end Word literature review construction and Word-specific citation/OOXML behavior, while this code chunk contains none of that functionality. Its primary behavior is a preprocessing/conversion utility, not Word document generation or review writing. Therefore the description materially overstates what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/acceptance.md (reported line 41)May include surrounding context.

XML Spot Checks

bash

rm -rf /tmp/docx_check && mkdir -p /tmp/docx_check
unzip -q output.docx -d /tmp/docx_check
rg 'REF _RefBib[0-9]+' /tmp/docx_check/word/document.xml
rg '<w:hyperlink' /tmp/docx_check/word/document.xml

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/acceptance.md (reported line 41)May include surrounding context.

XML Spot Checks

bash

rm -rf /tmp/docx_check && mkdir -p /tmp/docx_check
unzip -q output.docx -d /tmp/docx_check
rg 'REF _RefBib[0-9]+' /tmp/docx_check/word/document.xml
rg '<w:hyperlink' /tmp/docx_check/word/document.xml

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/self_check.py (reported line 251)May include surrounding context.

python

def run_self_check(args: argparse.Namespace) -> int:
    root = skill_root()
    env = os.environ.copy()
    env["PYTHONDONTWRITEBYTECODE"] = "1"
    env["PYTHONPATH"] = str(root / "scripts")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The release notes describe the skill exclusively in Chinese, which may impose a language requirement on users without opt-in. Under the policy, forcing a specific language without offering choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and instructs use of file and shell-capable helper scripts but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing tool restrictions can allow broader-than-necessary filesystem or shell access, increasing the chance of unintended file modification, data exposure, or command execution beyond the task's needs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The purpose statement says the skill creates literature reviews with 'Chinese thesis-style numeric citations,' which sets a specific language/locale expectation in natural language. While L028 later mentions a target language input and L003 mentions Chinese or English, this line still presents a locale-specific default in a way that could steer behavior without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

compile() call detected

Medium

• Category: Dangerous Code Execution
• Confidence: 65% confidence

Finding

compile() creates code objects from strings. When combined with exec()/eval(), it enables obfuscated code execution.

Content

Scanner excerpt · scripts/self_check.py (reported line 105)May include surrounding context.

python

def compile_scripts_in_memory(root: Path):
    for path in sorted((root / "scripts").glob("*.py")):
        source = path.read_text(encoding="utf-8")
        compile(source, str(path), "exec")
    log("script syntax ok")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self_check.py (reported line 111)May include surrounding context.

python

def run_cmd(cmd: list[str], cwd: Path, env: dict[str, str]) -> subprocess.CompletedProcess[str]:
    log("run: " + " ".join(str(part) for part in cmd))
    result = subprocess.run(cmd, cwd=cwd, env=env, text=True, capture_output=True)
    if result.stdout:
        print(result.stdout, end="")
    if result.stderr:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated review content uses fixed Chinese strings for the title and paragraph text, which imposes a specific language in the skill's behavior. There is no visible user opt-in, language selection mechanism, or documented justification for restricting output to Chinese in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese for the title and repository description, which can amount to a language-policy issue when the skill forces a specific language without offering a choice. There is no indication that the language is optional, user-selected, or justified as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file defines when the skill should be used, so SQP-1 applies. The phrase names several formats but then extends scope to "other common citation formats" without defining boundaries or exclusions, making invocation criteria less precise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The spec sets the default title to 文献综述 and describes it as the default without indicating that this behavior is optional or limited to Chinese-language workflows. This can violate a language/locale policy when users have not opted into Chinese output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI sets the default review title to the Chinese string "文献综述", which imposes a specific language choice when the user does not explicitly provide --title. This is a natural-language locale choice embedded in code and does not offer opt-in or automatic selection based on user preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.