ieee-reference-manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent IEEE bibliography helper, but it tells the agent to run project-provided Python helper scripts by filename, which creates a review-worthy code execution risk.

Use this only on trusted LaTeX/BibTeX projects. Before allowing any Bash command, inspect the exact script contents and path, approve the command explicitly, and avoid running project-supplied analyze_bib.py or nameTranslate.py in an environment with credentials or unrelated files. Expect DOI checks to use web access and review all proposed file edits before applying them.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:148

Finding

Execution of Untrusted Project-Local Helper Scripts

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:148-157
• references/utility-scripts.md:3
• references/utility-scripts.md:47
• references/utility-scripts.md:93

Vulnerability Type: Trusting and executing attacker-controlled local tools based solely on expected filenames
Risk Level: High

Vulnerable Code Snippets

English translation of the relevant documentation in SKILL.md:148-157:

markdown

The project may contain the following helper scripts. If present, use them preferentially:

### analyze_bib.py
- Function: Parse .bib files, detect duplicates, and analyze citation coverage
- Invocation: `python analyze_bib.py`

### nameTranslate.py
- Function: Replace hard-coded journal names in .bib files with IEEE standard macros
- Invocation: `python nameTranslate.py`

English translation of the relevant instruction in references/utility-scripts.md:3:

markdown

When these scripts exist in the project, preferentially invoke them directly. If they do not exist, use the following logic to temporarily write equivalent code or process the data directly with the LLM.

The documented commands at references/utility-scripts.md:47 and references/utility-scripts.md:93 are:

bash

python analyze_bib.py

bash

python nameTranslate.py

Technical Analysis

The Skill instructs the agent to execute helper scripts found in the user's document project based only on the filenames analyze_bib.py and nameTranslate.py. It does not require the agent to inspect their complete contents, validate their provenance or integrity, obtain explicit approval, or execute them in a restricted sandbox.

These scripts are not bundled in the audited Skill package. Consequently, their contents are controlled by whoever supplies the project being reviewed. Python executes top-level statements immediately, so a malicious file does not need to implement the advertised analysis func ...[truncated 2415 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to preferentially execute scripts merely because they have expected filenames.
2. Require the agent to read and audit the complete contents of every project-local script before considering execution. Reject scripts containing unrelated filesystem access, network access, subprocess invocation, dynamic evaluation, obfuscated content, or undeclared dependencies.
3. Present the exact command, script path, purpose, audit result, and expected file changes to the user, then require explicit approval before execution.
4. Prefer immutable helper scripts shipped as part of the reviewed Skill package rather than project-local implementations. Pin and verify their cryptographic hashes or signatures.
5. Resolve and validate the canonical script path before execution. Do not rely on the current working directory, PATH, aliases, wrappers, or filename-only lookup.
6. Execute approved scripts in a sandbox with:
   • Read-only access to input files by default.
   • Write access limited to a dedicated output directory.
   • No access to credentials, unrelated workspace files, or sensitive environment variables.
   • Network access disabled unless separately justified and approved.
   • Process, time, memory, and output limits.
7. Avoid executing scripts for operations that can be completed with existing constrained tools such as file reading, pattern matching, and deterministic in-memory analysis.
8. Remove Bash and other broad tools from allowed-tools if they are not essential. If Bash remains necessary, enforce command allowlisting and least-privilege execution.
9. Update references/utility-scripts.md so that it describes algorithms as non-executable reference material and explicitly prohibits running project-supplied implementations without verification and approval.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and the entire skill documentation are written as a Chinese-only assistant for managing IEEE references, with no indication that the user may choose another language. This creates a language/locale policy concern because it imposes a specific language by default without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: ieee-reference-manager
description: IEEE Trans 论文参考文献全流程管理助手。负责参考文献的格式校验、引用审查、BibTeX 条目修复、期刊名标准化、DOI/元数据在线验证、Early Access 处理、作者数量合规、重复条目检测等。当用户需要"检查参考文献"、"修复引用格式"、"验证 DOI"、"整理 bib 文件"、"参考文献审查"时触发。
allowed-tools: Read, Edit, Write, Bash, Glob, Grep, WebSearch, WebFetch, Agent
model: opus
---

# IEEE Trans 论文参考文献管理助手

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title and the entire document are written in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, nor does it explain that the skill is intentionally region- or audience-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill guidance is written exclusively in Chinese, including headings, instructions, and usage notes, with no indication that users may choose another language or that the skill is intended only for a Chinese-language context. This creates a natural-language locale constraint that appears to be imposed by the skill content rather than documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.