literature-review-tools

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill tells the agent to ask the user for API keys and then run a shell command embedding them (litrun.py env --set KEY=VALUE), which requires the LLM to handle and output secret values verbatim in generated commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In the required “Run” workflow, scripts/litrun.py executes topic-to-review* / pdf-* pipelines that invoke arxiv-fetch/openalex-fetch to download outsider-authored paper text (titles/abstracts or PDF contents converted to LLM-ready text) which is then ingested by paper-qa into the downstream LLM context, enabling indirect prompt injection via retrieved documents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). At runtime litrun.py's ui command clones and then installs/runs the upstream repositories (e.g., https://github.com/assafelovic/gpt-researcher and https://github.com/stanford-oval/storm), which fetches and executes remote code from those URLs, so these repos are runtime external dependencies that execute code.