Security audit
Security checks for vulnerabilities and agentic risk
The skill presents itself as a narrow offline bias-table helper, but the package also contains broad research pipeline tooling that can route workflows, write many workspace files, run subprocesses, and auto-approve checkpoints.
Install only if you intentionally want the larger research-pipeline helper bundle, not just a bias-assessment table updater. For a normal RoB annotation task, prefer a package limited to papers/extraction_table.csv with explicit file and command scope.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
The skill is described as a no-network CSV bias annotator, but the detected functionality audits drafts, LaTeX artifacts, PDFs, and reports across the workspace. This is a serious transparency failure: even without network access, broad local read/write behavior and document analysis can expose sensitive contents and alter outputs unrelated to the user's requested task.
This file implements a generic pipeline executor that can select units, modify workflow state, and launch arbitrary skill scripts, which is far broader than the declared bias-assessment purpose. In a skill advertised as only updating extraction-table bias fields, hidden orchestration capability creates a misleading trust boundary and enables execution of unrelated or unsafe actions inside the workspace.
The skill includes subprocess-based execution even though its manifest describes a non-networked, narrowly scoped table-population task. That mismatch makes the skill materially more dangerous because it can execute external code paths via scripts/run.py, potentially driving arbitrary repository behavior under the guise of a benign data-cleanup skill.
This file implements a large-scale research ideation and memo-generation pipeline that is materially unrelated to the declared bias-assessment skill. In an agent-skill setting, hidden capability drift is dangerous because invoking a seemingly narrow skill can trigger unauthorized analysis, ranking, and artifact generation, violating least-privilege expectations and increasing the chance of unintended data processing or workspace modification.
The code scores and prioritizes research directions, generates shortlists, and produces brainstorming outputs, which are capabilities far beyond bias assessment. This mismatch is risky because a caller selecting the skill based on its metadata may unknowingly grant it access to research notes and permit outputs that influence scientific planning, creating an integrity and scope-bypass problem.
The file implements a broad, multipurpose survey-pipeline gate with checks for retrieval, citations, drafting, LaTeX, merging, and other unrelated stages, far beyond the advertised bias-assessment function. In an agent setting, this kind of hidden capability expansion is dangerous because users may authorize a narrow skill while actually granting a much wider set of file access and workflow-control behaviors.
The manifest claims a bias-field population helper for papers/extraction_table.csv, but this code writes a generic output/QUALITY_GATE.md report and drives broader pipeline state transitions instead of performing the advertised extraction-table operation. That mismatch is risky because it can mislead users and orchestration systems into invoking a tool with far more authority and side effects than expected.
This skill is described as a no-network bias-assessment helper that should populate papers/extraction_table.csv, but the code invokes external PDF inspection logic as part of a general quality gate. That scope mismatch increases attack surface and can cause the skill to execute unintended local binaries or process untrusted PDFs, which is unnecessary for the declared task.
The skill declares no explicit tool scope even though its capabilities imply file read, file write, and shell access. That mismatch weakens least-privilege controls and can allow the skill to access or modify files or invoke commands beyond what a user would reasonably expect from a simple bias-assessment helper.
The pipeline is marked as routing_default: true and includes broad routing hints such as survey, review, 综述, and 调研, which can match many unrelated user requests. This can cause unintended invocation of a very large, high-authority workflow, potentially leading the agent to create or modify many artifacts without the user explicitly requesting this pipeline.
The document repeatedly defines the pipeline as specifically for Chinese thesis writing, beginning with the title and core goal describing a '中文毕业论文'. Under the policy, forcing a specific language or locale without offering user choice can be a natural-language policy violation unless clearly justified as region-specific; this file does not explicitly frame the constraint as an opt-in or compliance requirement.
The routing_hints include broad, everyday terms such as "idea" and "brainstorm," which can cause this pipeline to be selected for generic user requests that are not actually asking for a literature-grounded research-idea workflow. Misrouting can trigger unnecessary artifact creation and downstream stages, leading to incorrect workflow execution, user confusion, or unintended processing of workspace data.
The routing hint list includes "systematic", which is a common standalone term and is much broader than a specific invocation phrase. In a manifest-like file, this can cause unintended skill routing because it does not clearly constrain when the pipeline should activate versus when generic discussion of systematic methods should not.
The routing hint list includes the very generic term "tutorial", which can cause this pipeline to be selected for broad or ambiguous user requests that merely mention tutorials. Misrouting can lead the agent to create or modify the wrong artifacts and run an inappropriate workflow, especially because this pipeline has a relatively high routing priority and broad downstream write targets.
The manifest says this skill should add and populate bias/risk-of-bias fields in an existing extraction table, with no network access and a narrow, review-specific scope. In contrast, this module contains generic capabilities for status/decision log editing, approval workflow management, query seeding, pipeline spec resolution, template copying, and outline-state loading, which are materially broader than bias-assessment field population.
The presence of an auto_approve mechanism indicates the executor can automatically satisfy human approval checkpoints. In a narrowly scoped bias-assessment skill, embedding approval bypass capability is risky because it weakens human review guarantees and can advance pipeline state without intended oversight.
workspace: Path,
repo_root: Path,
strict: bool = False,
auto_approve: set[str] | None = None,
) -> RunResult:
units_path = workspace / "UNITS.csv"
status_path = workspace / "STATUS.md"
The code updates UNITS.csv, STATUS.md, and DECISIONS.md, not just the extraction table implied by the skill metadata. This broader write capability can alter workflow state, approvals, and execution tracking, which is inconsistent with a simple bias-assessor and increases the blast radius if the skill is triggered unexpectedly or misused.
This code normalizes a caller-supplied auto_approve set and prepares to use it in workflow decisions. That creates a mechanism for externally supplied approval tokens to influence execution state, which is unnecessary and overly powerful for a bias table updater.
table.save(units_path)
update_status_log(status_path, f"{now_iso_seconds()} {unit_id} DOING {skill}")
auto_approve_set = {str(x or "").strip().upper() for x in (auto_approve or set()) if str(x or "").strip()}
if owner == "HUMAN":
checkpoint = row.get("checkpoint", "").strip()
No suspicious patterns detected.