Security audit

Citation Injector

Security checks for vulnerabilities and agentic risk

Overview

The skill is presented as a narrow citation injector, but the package contains broader pipeline and execution tooling, and its citation script can modify draft files with under-scoped path and citation checks.

Install only if you are comfortable reviewing and running a broader research-pipeline bundle, not just a small citation injector. Use it in a sandboxed workspace, avoid custom `--inputs` or `--outputs` values from untrusted files, and verify the resulting draft citations against `citations/ref.bib` and the budget report before relying on the output.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.py:292
Finding: Unvalidated Workspace-Relative Paths Permit File Access Outside the Workspace
Content: View full analysis
Remediation: View remediation
Path: relative = Path(value) if relative.is_absolute(): raise ValueError(f"Absolute paths are not allowed: {value}") root = workspace.resolve() candidate = (root / relative).resolve(strict=False) try: candidate.relative_to(root) except ValueError as exc: raise ValueError(f"Path escapes workspace: {value}") from exc return candidate ``` 3. Apply this helper to every input, output, existence check, read, and write. 4. Prefer a fixed allowlist of exact paths for this Skill: - `output/DRAFT.md` - `output/CITATION_BUDGET_REPORT.md` - `output/CITATION_INJECTION_REPORT.md` - `citations/ref.bib` - Required files under `outline/` 5. Validate path fields when loading `UNITS.csv`, rather than only after a unit is launched. 6. Add regression tests covering absolute paths, `../` traversal, nested traversal, and symlinked workspace directories. 7. Run the Skill under an account or sandbox that cannot write outside the active workspace. ]]>

other

Note

Location: scripts/run.py:356
Finding: Fallback Citation Injection Bypasses Declared Scope and Bibliography Constraints
Content: View full analysis
0 and unique_after_h3 < target: pool: list[str] = [] for keys in suggestions.values(): for key in keys: cleaned = str(key or "").strip() if cleaned and cleaned not in pool: pool.append(cleaned) for key in _load_writer_pack_pool(workspace): if key not in pool: pool.append(key) remaining = [k for k in pool if k not in set(_extract_cites(draft))] if remaining: redistributed: list[str] = [] seen_after = set(_extract_cites(draft)) new_parts = [] for title, lines in _split_h3(draft): block = '\n'.join(lines).rstrip() if title is None: new_parts.append(block) continue if not remaining or len(seen_after) >= int(target): new_parts.append(block) continue take = min(3, max(1, int(target) - len(seen_after)), len(remaining)) chunk = remaining[:take] remaining = remaining[take:] sentences = _in_scope_sentences( chunk, title=title, context=pack_context.get(_norm_title(title)), ) if sentences: block = _inject_sentences_into_block(block, sentences) redistributed.extend(chunk) seen_after.update(chunk) modified_blocks += 1 new_parts.append(block) if redistributed: draft = '\n'.join(part for part in new_parts if part is not None).rstrip() + '\n' atomic_write_text(draft_path, draft) unique_after_h3 = len(set(_extract_cites(draft))) if target > 0 and ...[truncated 3565 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill mostly matches the broad purpose of raising unique citation counts in a draft using a budget report and local file processing. However, several material guardrails in the description are not enforced by the code. Most importantly, the code fabricates new explanatory sentences/templates (for section-level and global top-up insertion), which conflicts with 'NO NEW FACTS' and the framing of merely injecting citations into an existing draft. It also pulls fallback keys from writer_context_packs.jsonl and never checks citations/ref.bib, despite the declared rule to inject only keys present there and to skip if ref.bib is missing. Finally, the global top-up path can insert appendix/background citation sentences outside the per-H3 budgeted scope. These are substantive behavior differences, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear mismatch. The declared description is narrowly about injecting citations into an existing draft under strict scope and bibliography constraints, with no new facts. The supplied code contains no citation-processing logic, no draft parsing/editing for citations, no use of citation budget reports, no reading of citations/ref.bib, and no enforcement of H3 scope or anti-citation-dump rules. Instead, it is a reusable common utilities module supporting many unrelated workspace and pipeline operations. While local-only operation is consistent with the declared 'Network: none', the primary purpose and actual capabilities are materially different and substantially broader than described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is narrowly about safely injecting existing citations into draft text under scope/budget constraints. The supplied code does not manipulate citations, drafts, bibliography keys, citation budgets, or textual content at all. Instead, it is a general workflow runner for pipeline units: it picks runnable tasks, executes scripts, manages approvals and statuses, logs failures, checks outputs, and enforces pipeline-specific cutover and reroute rules. This is a materially different primary purpose with substantial undeclared capabilities and resource access, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear mismatch. The description promises a narrowly scoped citation-diversifier that edits an existing draft by inserting allowed citations under strict no-new-facts guardrails. The supplied code does nothing about citations, drafts, bib files, or citation-budget enforcement. Instead, it is a substantial ideation/report-generation module for research direction discovery and prioritization. Its primary purpose, inputs, outputs, and behaviors are all materially different from the declared skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a content-editing skill focused on injecting citations into draft text under strict scope and bibliography constraints. The supplied code does nothing related to citations, draft modification, bibliography access, or budget reports. Instead, it implements a pipeline specification loader/parser: reading files from disk, parsing YAML front matter, validating schema fields, resolving variant_of references, deep-merging overrides, applying list patches, and constructing PipelineSpec/PipelineStage objects. This is a materially different primary purpose and includes undeclared capabilities around configuration loading and filesystem-based pipeline resolution. The description therefore does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill should actively apply a citation budget report to a draft by inserting in-scope citations while respecting guardrails. The supplied code does not implement that workflow. Instead, it provides helper functions for parsing outlines, markdown H3 blocks, JSONL, and BibTeX keys, plus small citation-formatting helpers. While some functions are citation-related (reading bib keys, rendering citation lists), they are only supportive utilities and there is no end-to-end behavior matching the declared primary purpose: no draft rewriting, no budget report input, no H3 scope application, and no citation injection process. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is narrowly about modifying a draft by injecting citations within scope constraints. The supplied code does not inject citations into text at all. Instead, it is a comprehensive workspace quality/audit utility centered on validating outputs from many different skills, one of which is citation-injector via _check_citation_injection, but that function only checks whether CITATION_INJECTION_REPORT.md exists, is non-empty, has no placeholders, and reports PASS. The primary purpose is therefore materially different: quality gating and artifact validation rather than citation insertion. Resource usage is also much broader than declared, since the code reads numerous files across outline/, papers/, citations/, output/, and queries.md, and writes output/QUALITY_GATE.md. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is narrowly about applying a citation-diversifier budget report to inject in-scope citations into an existing draft while preserving facts. The supplied code does not inject citations or edit prose. Instead, it defines many _check_* functions for validating pipeline artifacts across the workspace: subsection/chapter briefs, coverage reports, evidence drafts, anchor sheets, schema normalization, writer context packs, evidence bindings, visuals, tables, transitions, section manifests, merged drafts, audit reports, and more. It also performs extensive quality checks on section prose, citation validity against citations/ref.bib, scope mapping against evidence bindings, and report PASS statuses. This is a materially different primary purpose and a much broader capability set than the declared skill. The mismatch is therefore clear and substantial.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for an editing/transformation skill whose main job is to inject existing citations into a draft under strict scope and no-new-facts constraints. The supplied code does not perform citation injection or draft rewriting. Instead, it implements a broad quality assurance checker that inspects text and files, emits QualityIssues, and validates many properties of drafts and downstream artifacts. While some checks are citation-related, they are evaluative heuristics (e.g., sparse citations, mid-sentence citation ratio, duplicate keys, subsection citation counts) rather than the described budget-report-driven citation insertion. The code also accesses resources and artifacts not mentioned in the description, including baseline anchor JSONL files, global review/protocol/tutorial spec files, LaTeX sources/logs, and compiled PDFs. This is a materially different primary purpose and a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
- `python scripts/run.py --workspace workspaces/<ws>`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
- `python scripts/run.py --workspace workspaces/<ws>`

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The provided file is a pipeline manifest for a literature snapshot workflow, not the claimed citation-injector skill. This mismatch can cause the wrong capability to be audited, routed, or invoked, undermining security review coverage and potentially allowing an actual skill to bypass intended scrutiny or controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The fallback path pulls keys from a global pool and redistributes them across H3 sections even when they were not suggested for that section, then finally appends global top-up prose. In a skill whose core safety guarantee is section-scoped, in-scope citation injection only, this can create out-of-scope citations, misattribute support to the wrong subsection, and silently corrupt scholarly provenance to satisfy a metric.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file implements a broad research-ideation pipeline—signal extraction, direction synthesis, ranking, shortlist generation, and memo/report assembly—which is materially outside the declared scope of a citation-injection skill. In an agent skill setting, such scope expansion is dangerous because the agent may invoke hidden or unrelated capabilities, causing unauthorized workspace changes, policy bypass, or task substitution under the guise of a narrow citation-editing tool.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code autonomously scores and ranks research directions, generates rationale, and prioritizes next steps, which gives the skill decision-shaping behavior unrelated to citation-budget application. In context, this increases risk because a user expecting mechanical citation insertion could instead trigger content planning or substantive draft steering, violating the 'NO NEW FACTS' and narrow-scope expectations of the skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no explicit tool/permission scope while its documented workflow includes direct file modification and optional shell-based script execution. In an agent framework, missing scope boundaries increases the chance that the skill can be invoked with broader-than-intended capabilities or be repurposed to alter files outside the expected draft artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The pipeline is configured with routing_default: true and broad routing_hints such as survey, review, and literature review, which can cause this skill to auto-match a wide range of common requests. That increases the chance of unintended invocation, especially since this pipeline is heavyweight and can steer the agent into a multi-stage workflow the user did not explicitly request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file documents optional online metadata enrichment via arXiv (enrich_metadata: true / arxiv-search --enrich-metadata) but does not present a clear user-facing notice at the point of use that external requests may be made. In agent settings, undisclosed network access can leak research topics, paper identifiers, or workflow intent to third-party services, even if the transmitted data seems low sensitivity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown repeatedly defines the pipeline as specifically for Chinese thesis writing, including the title and core goal of producing a '中文毕业论文'. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified as region-specific; this file does not clearly frame the restriction as an optional or compliance-bound locale choice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The routing hints include very broad trigger terms such as 'idea', 'brainstorm', and generic multilingual equivalents, which can cause this pipeline to be selected in contexts that do not actually require a research-idea workflow. Misrouting can expose unrelated user requests to a complex multi-stage literature pipeline, increasing the chance of unintended artifact generation, scope confusion, and downstream misuse of other skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The routing hint includes the broad phrase "one page," which is common in normal user requests and can trigger this pipeline unintentionally. In an agentic system, overly generic routing terms increase the chance of mis-invocation, causing the wrong workflow to run on unrelated tasks and weakening task isolation and operator intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The routing hint list includes very generic trigger phrases such as "peer review" and "review report," which can cause the pipeline to activate for broad, ambiguous user requests. In an agent system, overly broad routing increases the chance of misclassification, unintended execution paths, and application of the wrong workflow to sensitive or unrelated content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The routing hint list includes the single broad token "systematic", which can match many generic user requests unrelated to a PRISMA-style systematic review workflow. That increases the chance of accidental pipeline invocation, causing the wrong skills, artifacts, and review process to be applied to unrelated tasks and potentially degrading safety or correctness through misrouting.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code synthesizes new narrative sentences from templates and injects them into the draft rather than only attaching existing in-scope citations to existing claims. That violates the stated guardrail of 'NO NEW FACTS' in spirit and can introduce unsupported or misleading comparative statements such as broadening evidence, bounding comparison, or describing study relationships that were not present in the source draft.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · tooling/executor.py (reported line 105)May include surrounding context.
python
workspace: Path, repo_root: Path, strict: bool = False, auto_approve: set[str] | None = None, ) -> RunResult: units_path = workspace / "UNITS.csv" status_path = workspace / "STATUS.md"

Static analysis

No suspicious patterns detected.