Security audit
Security checks for vulnerabilities and agentic risk
This citation-management skill is broadly purpose-aligned, but users should know that online lookups send citation queries to external services and references are stored locally.
Before installing, treat this as a citation tool that can read citation/document files you point it at, store references in a local JSON database, and send DOI, ISBN, title, or author queries to Crossref or OpenLibrary. Avoid using it with confidential research topics unless you are comfortable with those external lookups. The publisher should remove the stray completion-summary generator files and fix the syntax error in the main Python file before relying on it operationally.
The use of exec(compile(code, '', 'exec')) enables dynamic code execution, which is unnecessary for a citation-management skill and defeats normal code review expectations. If the code variable is influenced or replaced, this becomes an arbitrary code execution primitive capable of running any Python with the agent's privileges.
The declared purpose focuses on adding references and standardizing citations, but the documented behavior extends to batch importing files, scanning inputs, persisting data into a local database, and exporting reports. This mismatch matters because it can hide materially broader data-handling behavior from users, leading them to provide documents or directories without realizing the skill may ingest and store more information than expected.
The file's title and the generated summary content are written entirely in Chinese and present the project summary in that language by default, without any indication that users can choose another language. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.
The file writes directly to a fixed path using write mode, which will silently overwrite any existing COMPLETION_SUMMARY.md at that location. In an agent setting, this can destroy prior user content or generated artifacts without confirmation, making it a real integrity risk even if it is not obviously malicious.
The file contains executable Python that writes to a fixed absolute path under /home/... despite being presented as a markdown summary. This is unrelated to citation-management behavior and can modify the local filesystem without user consent, which is risky in an agent skill context because documentation files are not expected to perform side effects.
The skill documentation advertises capabilities that imply file reads, file writes, and outbound network access, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege and transparency problem: an agent or user may invoke the skill without understanding that local files and external services can be accessed, increasing the risk of unintended data exposure or overly broad execution.
The skill mentions Crossref integration but does not clearly warn users that DOI, title, author, ISBN, or other citation queries may be transmitted to an external API. In research and thesis contexts, bibliographic queries can reveal sensitive project topics, unpublished work, reading lists, or institutional activity, so undisclosed external transmission creates a real privacy and compliance risk.
The Reference model defaults language to "en", which imposes a specific language/locale assumption in a user-facing academic citation tool. Because the file otherwise presents itself bilingually and does not offer opt-in or explain a regional limitation, this is a natural-language locale policy concern rather than a technical default alone.
When parsing Crossref responses, the code sets language to "en" unconditionally instead of using returned metadata or leaving the value unspecified. This creates a user-visible language policy issue because records from other languages will be misclassified without consent or documentation.
The OpenLibrary parser assigns language as "en" for all imported books, which hard-codes a language choice in a context where source materials may be multilingual. This is a natural-language policy violation because the tool forces a locale assumption rather than preserving or requesting the correct language.
The module docstring is entirely in Chinese and presents the skill purpose in that language only. For a general-purpose batch import tool, this is a natural-language locale constraint with no visible opt-in, alternative language, or explanation that the tool is region-specific.
The script writes a markdown file to disk without nearby disclosure, confirmation, or user-controlled destination. While the immediate action is limited to file creation, silent writes are still problematic in an agent environment because they create side effects users may not expect from opening or processing a documentation file.
This markdown file describes fetching metadata from Crossref and storing references in a local SQLite database, which affect privacy and user data persistence. While the features are stated, the README does not clearly warn users that DOI/ISBN/title queries may be sent to external services and that imported/generated reference data will be stored locally.
The BibTeX parser uses fields.get('language', 'en'), causing imported entries without a language field to be treated as English by default. This is a locale policy concern because it silently imposes a language classification on potentially non-English references.
The style alias mapping treats broad locale terms such as "chinese" and "uk" as direct selectors for specific citation styles. This can force a language/locale-specific interpretation from generic user input without any explicit opt-in or documented choice, which matches the locale-policy concern for natural-language configuration values.
This JSON manifest sets "default_language": "zh", which establishes a specific language preference in configuration without indicating user choice or a documented regional constraint. The policy allows language constraints only when users are offered a choice or the restriction is clearly justified, neither of which is evident in this file.
No suspicious patterns detected.
