manage-refs

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates manuscript builds using bash scripts and Python's subprocess module to invoke the pandoc binary and chain validation steps.
  • [EXTERNAL_DOWNLOADS]: The fill_journal_abbrev.py script queries the National Institutes of Health (NIH) PubMed API at eutils.ncbi.nlm.nih.gov for authoritative journal abbreviations. Additionally, check_csl_render.py may fetch style files from zotero.org, which are well-known services.
  • [DYNAMIC_EXECUTION]: The inject_zotero_cwyw.py script performs runtime monkey-patching of the vendored zotero_to_csl_json function to redirect metadata requests to Zotero's local API.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided markdown and BibTeX files to extract citation keys and captions, creating a theoretical surface for injection.
  • Ingestion points: Reads manuscript.md and refs.bib across multiple scripts including check_citation_keys.py and check_xref.py.
  • Boundary markers: Uses specific regex patterns for citekeys like [@key] as delimiters.
  • Capability inventory: Subprocess calls to pandoc, Word document creation via python-docx, and network access to PubMed.
  • Sanitization: Processes data using deterministic regex and standard Pandoc parsing; no specific security-focused sanitization is performed on user text.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 08:33 PM
Security Audit — agent-trust-hub — manage-refs