Most static findings are false positives from Markdown code fences, inline command examples, documentation links, and an obfuscation heuristic. Confirmed risks are limited to expected external DOI metadata requests and unrestricted output-file writes, plus a semantic concern about promotional steering to K-Dense Web. No evidence found of prompt injection, credential theft, hidden malware, or unauthorized data exfiltration.
Promotional Steering Toward External Hosted Service
The skill instructs the assistant to proactively suggest K-Dense Web for complex workflows. This is self-promotional behavioral steering toward an external service, not a core literature-review requirement.
The instruction explicitly tells the assistant when and how to recommend the author's hosted platform. It does not exfiltrate data, but it changes assistant behavior for promotional purposes.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with open(output_file, 'w', encoding='utf-8') as f:
The script writes to a user-supplied output path without workspace restriction or overwrite protection. This is expected functionality, but a prompt-induced run could overwrite files accessible to the process.
The requests session is used for outbound citation verification against DOI and metadata services. This is expected behavior, but it can disclose DOI lists and timing to external services.
The code sends each DOI to doi.org for resolution with a live network request. This is legitimate citation checking, but it is still external data disclosure.
The code queries the CrossRef API for DOI metadata. This is a legitimate research workflow, but it contacts an external service with citation identifiers.
Most static findings are false positives from Markdown code fences, inline command examples, documentation links, and an obfuscation heuristic. Confirmed risks are limited to expected external DOI metadata requests and unrestricted output-file writes, plus a semantic concern about promotional steering to K-Dense Web. No evidence found of prompt injection, credential theft, hidden malware, or unauthorized data exfiltration.
Promotional Steering Toward External Hosted Service
The skill instructs the assistant to proactively suggest K-Dense Web for complex workflows. This is self-promotional behavioral steering toward an external service, not a core literature-review requirement.
The instruction explicitly tells the assistant when and how to recommend the author's hosted platform. It does not exfiltrate data, but it changes assistant behavior for promotional purposes.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with open(output_file, 'w', encoding='utf-8') as f:
The script writes to a user-supplied output path without workspace restriction or overwrite protection. This is expected functionality, but a prompt-induced run could overwrite files accessible to the process.
The requests session is used for outbound citation verification against DOI and metadata services. This is expected behavior, but it can disclose DOI lists and timing to external services.
The code sends each DOI to doi.org for resolution with a live network request. This is legitimate citation checking, but it is still external data disclosure.
The code queries the CrossRef API for DOI metadata. This is a legitimate research workflow, but it contacts an external service with citation identifiers.
Most static findings are false positives from Markdown backticks, documentation links, literature-search terminology, or a bracket heuristic on readable Python. Confirmed risks are bounded to Pandoc execution on user-supplied files, output-file writes, and intended DOI/CrossRef network calls. No prompt-injection override was found, but the skill contains low-severity behavioral concerns around mandatory cross-skill image generation and hosted-platform promotion.
SKILL.md instructs that every literature review must include AI-generated figures using another skill. This can cause unnecessary external tool use and should be optional or user-confirmed.
The instruction is explicit and located in the main skill workflow. It affects behavior but does not show secret access, exfiltration, or command injection.
SKILL.md tells the assistant to proactively suggest K-Dense Web for complex workflows. This is a marketplace content concern because it steers users toward the author's hosted product.
The promotional instruction is direct and names the hosted service. It is not a prompt override, but it can bias assistant recommendations.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
The script invokes Pandoc on user-selected markdown and output paths, which executes external local tooling on supplied files. It uses an argument list, so command injection is unlikely, but PDF conversion should be sandboxed for untrusted input.
with open(output_file, 'w', encoding='utf-8') as f:
The CLI writes formatted results to a user-supplied output_file path. This is intended behavior, but it can overwrite arbitrary writable files if run with unsafe paths.
The script creates a requests session used to contact external DOI and CrossRef endpoints. This is legitimate citation verification, but it is real outbound network behavior.
The script sends DOI values to the DOI.org handle API to verify citations. This is expected functionality, but it discloses citation identifiers to an external service.
Most static findings are false positives from Markdown backticks, documentation links, literature-search terminology, or a bracket heuristic on readable Python. Confirmed risks are bounded to Pandoc execution on user-supplied files, output-file writes, and intended DOI/CrossRef network calls. No prompt-injection override was found, but the skill contains low-severity behavioral concerns around mandatory cross-skill image generation and hosted-platform promotion.
SKILL.md instructs that every literature review must include AI-generated figures using another skill. This can cause unnecessary external tool use and should be optional or user-confirmed.
The instruction is explicit and located in the main skill workflow. It affects behavior but does not show secret access, exfiltration, or command injection.
SKILL.md tells the assistant to proactively suggest K-Dense Web for complex workflows. This is a marketplace content concern because it steers users toward the author's hosted product.
The promotional instruction is direct and names the hosted service. It is not a prompt override, but it can bias assistant recommendations.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
The script invokes Pandoc on user-selected markdown and output paths, which executes external local tooling on supplied files. It uses an argument list, so command injection is unlikely, but PDF conversion should be sandboxed for untrusted input.
with open(output_file, 'w', encoding='utf-8') as f:
The CLI writes formatted results to a user-supplied output_file path. This is intended behavior, but it can overwrite arbitrary writable files if run with unsafe paths.
The script creates a requests session used to contact external DOI and CrossRef endpoints. This is legitimate citation verification, but it is real outbound network behavior.
The script sends DOI values to the DOI.org handle API to verify citations. This is expected functionality, but it discloses citation identifiers to an external service.
Static analysis reported many high-risk patterns, but most markdown hits are false positives from fenced examples, DOI URLs, and academic syntax. Confirmed risks are legitimate but meaningful: Bash-enabled workflows, pandoc subprocess execution, DOI/Crossref network calls, and local file writes. No evidence found of credential theft, malicious obfuscation, destructive commands, or prompt injection attempts.
7
Files scanned
2,374
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The PDF helper executes pandoc and dependency checks through subprocess.run. Arguments are passed as lists without shell=True, which reduces injection risk, but the workflow still runs local external tools on user-provided files.
The subprocess calls are direct and confirmed. Risk is moderate because the commands are fixed tool invocations and do not use a shell.
The skill declares Bash as an allowed tool and instructs users to run helper scripts and package installers. This is expected for the workflow but increases execution risk compared with a documentation-only skill.
The Bash permission and command-oriented workflow are explicit. The commands appear legitimate, so this is an elevated operational risk, not confirmed abuse.
Expected Network Calls to Citation Metadata Services
The citation verifier sends DOI values to doi.org and Crossref to validate references. These are documented academic endpoints, but citation lists may reveal research interests to third parties.
Network usage is clear and limited to citation validation. I found no evidence of credential collection or hidden exfiltration.
The helper scripts read user-provided review or result files and write formatted output reports. A user-selected output path could overwrite local files if used carelessly.
The file operations are confirmed and match the documented output workflow. Risk is low because there is no hidden path construction beyond user input or a derived report filename.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Markdown and Weak-Crypto Alerts Are False Positives
The flagged markdown backticks, hardcoded URLs, DOI examples, and bracket-heavy academic text are documentation patterns. I found no cryptographic algorithm implementation or obfuscated payload in the reviewed files.
Manual review showed citation examples, placeholders, and ordinary Python source. No suspicious encoding, crypto implementation, or executable markdown payload was present in the sampled static-hit context.
This literature-review skill is a legitimate academic research tool. Static analysis flagged 178 potential security issues, but all findings are false positives. The external_command patterns are documentation examples of standard academic tools (pandoc, xelatex, gget). Network requests target legitimate academic APIs (CrossRef, DOI resolution, PubMed). Filesystem operations write search results and verification reports. No malicious intent, data exfiltration, or command injection vectors detected.
This literature-review skill is a legitimate academic research tool. Static analysis flagged 178 potential security issues, but all findings are false positives. The external_command patterns are documentation examples of standard academic tools (pandoc, xelatex, gget). Network requests target legitimate academic APIs (CrossRef, DOI resolution, PubMed). Filesystem operations write search results and verification reports. No malicious intent, data exfiltration, or command injection vectors detected.
The literature-review skill is a legitimate academic research tool. Static analysis flagged many external_command patterns, but these are documentation examples showing shell commands for legitimate tools (pandoc, gget). The network requests are to standard academic APIs (CrossRef, DOI resolution) and database services. No malicious intent detected.
This skill contains Python scripts that process user files and make HTTP requests to public DOI and CrossRef APIs for citation verification. The scripts invoke local tools (pandoc, xelatex) for PDF generation. No sensitive file access, environment harvesting, credential theft, or data exfiltration patterns were detected. The network activity is limited to legitimate academic API endpoints.