Versioned security assessment

Report ID: SA-95A62FCB

6/30/2026, 6:17:04 AM

citation-management security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
citation-management
Version
v5
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/citation-management
Coverage
14 Files scanned · 8,213 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high-risk patterns, but review found no confirmed malicious intent, prompt injection, hidden command execution, or obfuscated payloads. The real risks are expected for this skill: external academic API calls, optional NCBI credential use, optional Google Scholar proxying, and local file writes. Publish with a network, credential, and file-overwrite warning.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

14 Files scanned · 8,213 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Capability review items (1)
Low
SKILL.md:79-97assets/citation_checklist.md:30-47references/pubmed_search.md:500-504
Markdown Command Examples Require User Judgment
Verdict: FALSE_POSITIVE for automatic execution, with minor operational risk. The skill documentation includes many shell examples for running local Python scripts and installing dependencies. They are instructions for the user, not hidden command execution, but users should review commands before running them.
The suspicious syntax is located in Markdown examples and setup guidance. The executable scripts reviewed do not contain shell-spawning APIs, but the documentation still asks users to run commands manually.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 Medium
scripts/doi_to_bibtex.py:43scripts/extract_metadata.py:108scripts/search_pubmed.py:30-31scripts/validate_citations.py:212-217
Expected External Academic API Access
Verdict: TRUE_POSITIVE for network access, but legitimate for this skill. The scripts call DOI, CrossRef, PubMed, arXiv, and Google Scholar services to retrieve citation metadata. This can expose search terms and identifiers to those services, so users need a network-access warning rather than a block.
Direct HTTP client usage and hardcoded academic API URLs were confirmed in executable scripts. The behavior matches the documented citation workflow, so risk is privacy and dependency exposure, not malicious exfiltration.
RISK-002 Medium
scripts/search_pubmed.py:28-29scripts/search_pubmed.py:79-80scripts/extract_metadata.py:162-164
NCBI Credential Environment Access
Verdict: TRUE_POSITIVE for environment access. PubMed-related scripts read NCBI_API_KEY and NCBI_EMAIL and include them in NCBI API parameters. This is a normal E-utilities pattern, but it handles user credentials and should be disclosed.
The environment variable names and API parameter use are explicit. I found no evidence that credentials are sent anywhere except the NCBI E-utilities workflow.
RISK-003 Medium
scripts/search_google_scholar.py:32-37
Optional Third-Party Proxy for Google Scholar
Verdict: TRUE_POSITIVE for a privacy-sensitive option. The Google Scholar script can enable free proxies through the scholarly library. This may route research queries through third-party infrastructure, even though it is opt-in and intended to avoid rate limiting.
The code explicitly creates a ProxyGenerator and enables FreeProxies when requested. The exact proxy provider is controlled by the scholarly library, so the privacy impact is clear but contextual.
RISK-004 Low
scripts/doi_to_bibtex.py:188-189scripts/extract_metadata.py:558-559scripts/format_bibtex.py:284-285scripts/validate_citations.py:486
User-Controlled File Writes and In-Place Formatting
Verdict: TRUE_POSITIVE for filesystem writes. The scripts write generated citations, reports, or formatted BibTeX to user-selected paths, and the formatter overwrites the input file when no output path is supplied. This is expected CLI behavior but can overwrite local files if used carelessly.
The write calls are direct and visible. They use paths supplied by command-line arguments or the input file, which makes the behavior user-directed rather than hidden.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
SKILL.md:44-46references/bibtex_formatting.md:22-34scripts/format_bibtex.py:104scripts/extract_metadata.py:1
Static Command, Crypto, and Obfuscation Alerts Are False Positives
Verdict: FALSE_POSITIVE for most external command, weak cryptography, and obfuscation alerts. The backtick detections occur in Markdown command examples and BibTeX documentation, not Ruby execution. The weak crypto and certificate/key alerts are caused by citation words such as key and BibTeX syntax. No evidence found of eval, subprocess, os.system, encoded payloads, or prompt-injection override text.
Targeted review found documentation examples and ordinary Python data structures at representative flagged locations. Because the static list is very large, this is a category-level evaluation rather than line-by-line confirmation of every duplicate alert.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable