Security audit

Academic Citation Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill performs expected citation-management tasks, but users should understand that metadata lookups contact third-party services and should not run the bundled summary markdown files as scripts.

Install only if you are comfortable with citation titles, authors, DOI, or ISBN values being sent to Crossref/Open Library during lookup features. Use the documented CLI/API entry points, keep exports in user-chosen paths, and do not execute COMPLETION_SUMMARY.md or PROJECT_COMPLETION_SUMMARY.md as code.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation describes capabilities to read local files, write output files, and perform network requests to Crossref, but the skill declares no permissions. This mismatch can cause the host or user to underestimate the skill's actual access needs, reducing informed consent and weakening permission-based security controls, especially because it processes user-supplied documents and external metadata.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The file is labeled as a Markdown summary, but it contains executable Python that writes to disk. This mismatch is dangerous because downstream tooling or reviewers may treat the file as inert documentation while it actually performs a filesystem side effect, enabling unexpected overwrite behavior if the content is executed.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code writes to a fixed absolute path on the local filesystem without demonstrating a user need for that capability or validating the destination. In an agent skill context, hardcoded file writes can overwrite existing files, leak environmental assumptions, and create unsafe side effects on the host where the skill runs.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This file is presented as a Markdown project summary, but it contains Python code that writes to a fixed path on disk. Hidden file-write side effects in a documentation-like file are risky because they can alter the local workspace unexpectedly and are not necessary for citation-management functionality.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The use of exec(compile(code, ...)) enables dynamic execution of code, which is a powerful and unnecessary capability for a citation-management skill summary file. If the code variable is influenced or replaced, this can lead to arbitrary code execution in the user's environment.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file silently writes a completion summary to a predetermined path without any user-facing warning, consent, or documentation of the side effect. Hidden write behavior is risky in agent-operated environments because it can surprise operators, bypass expectations of read-only analysis, and alter local state in ways that are hard to audit.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The code creates a Markdown file on disk without clear inline disclosure to the user, which creates an undocumented side effect. Even when the written content is benign, silent filesystem modification reduces transparency and can be abused to overwrite expected artifacts in the workspace.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The README prominently documents DOI/ISBN/title lookups against Crossref and other external sources, but does not clearly warn users that citation metadata and user-supplied queries may be transmitted to third-party services. In a research workflow, these queries can reveal sensitive topics, unpublished work, reading lists, or thesis directions, creating a privacy and data-handling risk even if the feature is legitimate.

Static analysis

No suspicious patterns detected.