Security audit
Security checks for vulnerabilities and agentic risk
The skill is a plausible citation helper, but it needs review because its install steps run unpinned remote code and its document-editing scripts can modify files too broadly.
Install only if you are comfortable reviewing the dependency setup and running it in a contained environment. Pin the academic-search dependency before running its scripts, use a virtual environment with pinned Python packages, keep backups, prefer explicit --output paths, review diffs before accepting edits, and do not compile generated LaTeX with shell escape enabled.
SKILL.md:39Execution of an Unpinned Remote Installation Script
SKILL.md:45Unpinned and Unnecessary Python Dependencies
scripts/insert_citation.py:135LaTeX Bibliography Path Traversal Allows Writes Outside the Document Directory
scripts/format_citation.py:143Untrusted Citation Metadata Is Inserted into Executable LaTeX Without Escaping
If the actual functionality is limited to document parsing and query suggestion while the description promises external retrieval, citation generation, and insertion, users may misjudge the trust boundary and data flow. Although this is less directly dangerous than arbitrary code execution, it still creates a security and safety issue through misleading capability claims and unclear handling of user documents.
If the actual functionality is limited to document parsing and query suggestion while the description promises external retrieval, citation generation, and insertion, users may misjudge the trust boundary and data flow. Although this is less directly dangerous than arbitrary code execution, it still creates a security and safety issue through misleading capability claims and unclear handling of user documents.
If the actual functionality is limited to document parsing and query suggestion while the description promises external retrieval, citation generation, and insertion, users may misjudge the trust boundary and data flow. Although this is less directly dangerous than arbitrary code execution, it still creates a security and safety issue through misleading capability claims and unclear handling of user documents.
The documentation emphasizes external academic-search integration but does not clearly disclose that document-derived content such as topics, keywords, titles, or excerpts may be sent to external services including third-party platforms. In an academic writing context, this can expose unpublished research topics, proprietary material, or sensitive manuscript content, making the omission more dangerous than in a purely local formatting tool.
The README describes automatic insertion and file generation workflows but does not prominently warn that the skill modifies user documents and may create new output artifacts such as .bib, .txt, or rewritten document files. Users may invoke the skill expecting advice only, leading to integrity risks, overwritten work, or unexpected repository changes.
The trigger phrases are broad enough to match ordinary editing requests such as 'add references' or handling common document types, which can cause the skill to activate in situations where the user did not explicitly consent to citation insertion, file modification, or external searches. In this skill’s context, that increases the chance of unintended document changes and accidental transmission of document-derived keywords to third-party academic search services.
The skill declares commands that read user-supplied documents and later write modified outputs, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, undocumented file read/write capability increases the chance of unintended access to local files or unsafe document modification because users and reviewers cannot clearly constrain what paths or operations are allowed.
The activation logic includes broad file-based triggers such as opening .md, .tex, or .docx files with insufficient citations, which can cause the skill to activate in ordinary document-editing contexts without a clear user request for citation assistance. Over-broad triggering is dangerous in a skill that reads and potentially writes documents, because it can initiate unintended analysis or modification of sensitive academic files.
Several trigger phrases are generic enough to overlap with routine editing or research-help requests, increasing the likelihood of accidental invocation. In this context the risk is limited but real, because accidental activation can still lead to unnecessary document parsing, external search planning, or file modification workflows.
The example workflow explicitly describes generating BibTeX entries and inserting \cite{} commands into project files, but it does not show a clear user-facing warning that the skill will modify document contents and bibliography files. In an agent setting, omission of an explicit confirmation or change notice can cause unintended file edits, especially when users may interpret the request as advisory rather than write-enabled.
The Word-document workflow shows direct insertion into a user-specified .docx file after parsing and citation generation, but it lacks an explicit warning that the file will be modified in place. This increases the risk of surprising or destructive edits to user documents, particularly for binary formats like Word where changes are harder to inspect and revert than plain text.
This Python file includes user-facing descriptive text in Chinese in the module docstring, while the policy forbids forcing a specific language or locale without opt-in. No adjacent text indicates that Chinese output or documentation is optional, user-selectable, or justified as a region-specific tool.
The script writes back to the original Markdown/LaTeX/Word document by default and, in the LaTeX BibTeX path, may also append to an existing .bib file, all without any explicit confirmation step. In an agent skill that may be triggered from a natural-language request like '帮我加参考文献', this creates a real integrity risk: the tool can silently and irreversibly alter user content or related project files if invoked on the wrong file or with incorrect citations.
This code file contains natural-language descriptions entirely in Chinese, including the top-level module description and class/method docstrings elsewhere in the file, without offering an opt-in, localization choice, or documenting a justified region-specific constraint. That creates a language/locale policy concern because it implicitly fixes the skill experience to one language for maintainers and potentially users.
The README is written entirely in Chinese and presents all invocation examples and user interaction prompts in Chinese, without indicating that other languages are supported or that the locale is intentionally limited. This can constitute a language/locale policy issue when a skill implicitly enforces a specific language without offering user choice or documenting the constraint.
This markdown file presents all instructions and examples exclusively in Chinese, and does not indicate that users can choose another language. The policy for natural-language violations applies to markdown content, and forcing a single language without opt-in can be a locale/language policy concern.
Multiple user-facing docstrings describe the tool only in Chinese, which can amount to a fixed language choice rather than offering users a locale option. The file does not indicate that Chinese-only output is intentional, optional, or limited to a region-specific context.
No suspicious patterns detected.