Agent skill · Audited from source
industrial-ai-research
skill · bahayonghang/academic-writing-skillsLicence not declaredAudited 22 Oct 2026 · source da871dac3b12
Is it safe? No — BLOCK, grade D (62/100). We read this skill's source at commit da871dac3b12 and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 25 findings, 5 critical or high. What it does: Search and cite from local BibTeX/BibLaTeX .bib libraries, including Zotero exports. Use to find, filter, preview, export, or generate LaTeX/Typst citation snippets by topic, author, year, venue, DOI, arXiv ID,…
Cite
Cite this page
ModelsAtlas. “industrial-ai-research (bahayonghang/academic-writing-skills)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/bahayonghang/industrial-ai-research
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 5 critical or high findings, starting with “Prompt injection” in docs/skills/typst-paper/resources/references/modules/DEAI.md:36. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 22 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.
What the source does
- FilesystemDeclared3 observations
- NetworkDeclared6 observations
- ShellDeclared1 observation
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 6 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 13 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 6 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (25)
HIGHPrompt injectionprompt.zero_width · docs/skills/typst-paper/resources/references/modules/DEAI.md:36
Protect four types of content first, and then reduce the AI flavor:
- Why
- invisible characters in instruction text
- Fix
- strip non-printing characters
HIGHPrompt injectionprompt.zero_width · docs/zh/skills/cover-letter/resources/references/LETTER_STRUCTURE.md:15
- 稿件标题和文章类型。
- Why
- invisible characters in instruction text
- Fix
- strip non-printing characters
HIGHPrompt injectionprompt.zero_width · docs/zh/skills/cover-letter/resources/templates/nature.md:37
- 在第一段中明确指出稿件标题和文章类型。
- Why
- invisible characters in instruction text
- Fix
- strip non-printing characters
HIGHPrompt injectionprompt.zero_width · docs/zh/skills/latex-paper-en/resources/references/citations/verification.md:24
- [ ] **第 1 步**:使用 Exa MCP 或 Semantic Scholar API 进行搜索
- Why
- invisible characters in instruction text
- Fix
- strip non-printing characters
HIGHPrompt injectionprompt.zero_width · docs/zh/skills/latex-paper-en/resources/references/citations/verification.md:110
然后使用 Semantic Scholar API 验证结果并通过 DOI 获取 BibTeX。
- Why
- invisible characters in instruction text
- Fix
- strip non-printing characters
MEDIUMObfuscation / stealthobf.homoglyph · academic-writing-skills/latex-thesis-zh/scripts/polish_unit_zh.py:56
r"(?:\s*(?:\\%|[%%])|(?:\s|\\,)*[A-Za-zμμ°C°]+[0123456789−+]*"
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.homoglyph · academic-writing-skills/latex-thesis-zh/scripts/polish_unit_zh.py:57
r"(?:[/·][A-Za-zμμ]+[0123456789−+]*)?)?"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
LOWInventory / provenanceinv.suspicious_name · .trellis/tasks/archive/2026-08/08-09-method-description-upgrade/research/c2-handoff.md
c2-handoff.md
- Why
- member named after an attack tool
- Fix
- remove or justify
LOWInventory / provenanceinv.suspicious_name · .trellis/tasks/archive/2026-09/09-23-defense-zh-extract-build/research/c2-evidence.md
c2-evidence.md
- Why
- member named after an attack tool
- Fix
- remove or justify
LOWCode injectioncode.eval_exec · tests/skills/typst_paper/test_typst_paper_coverage.py:151
"exec(open(r'%s').read())" % (SCRIPT_DIR_TYPST / "deai_check.py")
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWInsecure cryptocrypto.weak_hash · .trellis/tasks/archive/2026-07/07-05-deai-alignment-lock/research/probe_alignment.py:50
return hashlib.md5(payload.encode("utf-8")).hexdigest()[:8]- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · .trellis/tasks/archive/2026-07/07-05-deai-alignment-lock/research/probe_classify.py:31
return hashlib.md5(ast.dump(tree).encode()).hexdigest()[:8]
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · tests/contracts/test_deai_alignment.py:113
return hashlib.md5(payload.encode("utf-8")).hexdigest()- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · tests/contracts/test_deai_alignment.py:130
return hashlib.md5(ast.dump(tree).encode("utf-8")).hexdigest()- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · tests/contracts/test_parsers_alignment.py:71
return hashlib.md5(payload.encode("utf-8")).hexdigest()- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · tests/shared/test_tex_loader_security.py:117
f"\\input{{{chapter.as_posix()}}}\n% \\input{{../../outside}}\n",- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · tests/skills/paper_audit/test_workspace_layout.py:70
assert layout.section_file("../../etc/passwd") == layout.sections_dir / "passwd"- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · docs/package.json
vitepress, vue
- Why
- 2 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
headroom-ai
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · requirements.txt
Pillow, PyYAML
- Why
- 2 requirement(s) not pinned with ==
- Fix
- pin exact versions
LOWPrompt injectionprompt.authority_framing · academic-writing-skills/paper-audit/agents/domain_reviewer_agent.md:5
You are a senior domain expert reviewing this paper for its contribution to the field. You evaluate whether the paper accurately represents existing knowledge, positions itself correctly within the li
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha da871dac3b12 · 22 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherbahayonghang GitHub userOwner of the repository this skill is read from
- Source folderbahayonghang/academic-writing-skillsThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdictda871dac3b12A new audit runs when the source changes
- Repository statusNot archivedLast push 6 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Search and cite from local BibTeX/BibLaTeX .bib libraries, including Zotero exports. Use to find, filter, preview, export, or generate LaTeX/Typst citation snippets by topic, author, year, venue, DOI, arXiv ID,…
---
name: bib-search-citation
description: Search and cite from local BibTeX/BibLaTeX .bib libraries, including Zotero exports. Use to find, filter, preview, export, or generate LaTeX/Typst citation snippets by topic, author, year, venue, DOI, arXiv ID, keywords, abstract, fields, recency, or claim support. Do not use for manuscript writing or polishing.
when_to_use: >-
Trigger on prompts like "search my references.bib", "find papers by author/year/venue",
"Mamba papers after 2024", "generate \cite{} snippets", "export selected BibTeX",
"filter Zotero export", "check DOI/arXiv IDs", or "find citations supporting this claim".
metadata:
category: academic-writing
tags:
[
bibtex,
biblatex,
citation,
latex,
typst,
bibliography,
research,
zotero,
bib,
]
version: "6.0.0"
last_updated: "2026-07-16"
argument-hint: "--bib library.bib --query QUERY"
allowed-tools: Read, Bash(uv *)
---
# Bib Search Citation
## Capability Summary
Research-oriented retrieval over a local `.bib` file (BibTeX/BibLaTeX, including
Zotero exports with fields like `shorttitle`, `annotation`, `keywords`,
`abstract`, `file`, DOI, URL, eprint). Searches by topic and field filters,
returns stable JSON, renders compact previews, emits LaTeX/Typst citation
snippets, and returns raw BibTeX only when exact export or manual verification
requires it.
## Triggering
Requests such as: "Search my `.bib` file for recent Mamba forecasting papers",
"Find entries by Cheng after 2024 that have code and return cite snippets",
"Show the raw BibTeX for the best match", "Filter Zotero-exported entries whose
annotation mentions CodeAvailable", "Preview the JSON output from a saved
search". For a natural-language request, infer a conservative search spec and
state the assumptions. If the user gives a compact filter expression, preserve
it closely instead of translating it into vague prose.
## Do Not Use
- validating citations already used inside a `.tex`/`.typ` project (use the
writing skill's bibliography module)
- compiling, formatting, or diagnosing manuscript source trees
- rewriting related-work prose
- online discovery with no local `.bib` file (use a research workflow and
verify external metadata first)
- inventing bibliographic metadata missing from the `.bib` file
## Module Router
| Module | Best for | Command |
| ----------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `query` | one-shot compact search with inline filters | `uv run python -B $SKILL_DIR/scripts/search_bib.py --bib references.bib --query 'mamba forecasting author:Cheng year>=2024 has:code cite:both limit:5'` |
| `spec-json` | structured search spec generated from a complex request | `uv run python -B $SKILL_DIR/scripts/search_bib.py --bib references.bib --spec-json '{"query":"mamba forecasting","filters":{"year_min":2024},"citation_mode":"both"}'` |
| `spec-file` | repeatable saved search workflow | `uv run python -B $SKILL_DIR/scripts/search_bib.py --bib references.bib --spec-file search.json` |
| `preview` | compact human-readable summary after JSON search output exists | `uv run python -B $SKILL_DIR/scripts/preview_bib_search.py --input results.json` |
`search_bib.py` is the source of truth for parsing, filtering, scoring, sorting,
raw BibTeX preservation, and citations; `preview_bib_search.py` renders only.
## Required Inputs
- path to one local `.bib` file
- one of compact `--query`, inline `--spec-json`, or saved `--spec-file`
- optional sort, limit, citation-mode, raw BibTeX, or returned-field preferences
Common spec fields: `query`; `filters.year_min/year_max/years_in/exclude_years`,
`filters.author_contains/author_excludes`, `filters.type_in/exclude_type_in`,
`filters.has/exclude_has`, `filters.field_contains/field_excludes`;
`sort` (`relevance`, `year_desc`, `year_asc`, `title`); `limit` (default 5);
`return_fields`; `include_raw_bib` (`true` only for original entries or exact
export); `citation_mode` (`latex`, `typst`, `both`, `none`). Defaults and
compact operator syntax: `references/search-planning.md`.
## Output Contract
Presentation order:
1. State how many matches were found and which filters were applied.
2. List top matches with requested research fields.
3. Include LaTeX and/or Typst snippets when requested or useful.
4. Include raw BibTeX only when requested or materially needed.
5. If no entries match, suggest specific filter relaxations.
6. Surface `meta.recency` when recency matters, and the per-result
`claim_support` block when `--claim` was supplied — always repeating its
caveat: lexical overlap is not proof of support.
Per entry, usually include: citation key; title (and shorttitle); authors; year
and venue/journal/booktitle; DOI/eprint when present; the supporting fields that
made it relevant; and when useful a provenance note — local `.bib` matches and
cite snippets are bibliography evidence, not proof of claim support. Echo the
interpreted filters when negation, field filters, or mixed options could be
ambiguous.
## Workflow
1. Identify the `.bib` path; ask one concise clarification only if choosing
among candidates would be risky.
2. Translate the request into a compact query or JSON search spec.
3. Run `search_bib.py` with `uv run python -B`; preserve the JSON output.
4. Optionally run `preview_bib_sExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit da871da
uv run python scripts/analyze_logic.py INPUT [--section SECTION] [--first-chapter N] [--chapter-intro-style] uv run python scripts/check_references.py INPUT uv run python scripts/verify_bib.py FILE.bib uv run python scripts/analyze_literature.py INPUT uv run python docs/scripts/check_resource_sync.py --inventory-only uv run python docs/scripts/check_resource_sync.py --skill <skill-name>
git clone https://github.com/bahayonghang/academic-writing-skills git -C academic-writing-skills checkout da871dac3b12
Commands as the repository documents them: shown, never run by us. Our verdict covers commit da871dac3b12 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| Gemini CLI | Mentioned in its text, not tested | Skills for Gemini CLI · About Gemini CLI |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
| Windsurf | Mentioned in its text, not tested | Skills for Windsurf · About Windsurf |
Audit history
Every audit, every source change
- ✕BLOCK D 62 / 100
first audit · source
da871dac3b12
Similar skills
All research skills →bahayonghang/academic-writing-skills
Reviewer-style audit and submission gate for academic papers in .tex, .typ, or .pdf. Use for peer-review critique, readiness/gate decisions, blocker triage, revision roadmaps, journal-style reports, re-audits, and…
bahayonghang/academic-writing-skills
Typst paper assistant for existing .typ manuscripts in English or Chinese. Use for compile/export diagnosis, venue formatting, BibTeX/Hayagriva checks, grammar, logic, abstract/title, tables, pseudocode, related work,…
bahayonghang/academic-writing-skills
中文 LaTeX 学位论文助手,面向已有 .tex 硕博论文工程与学位论文评阅书:编译诊断、GB/T 7714、模板识别、结构/格式/公式断行、术语一致性、逻辑与文献综述、方法/工程应用章、标题优化、去 AI 味、主张前置(自我削弱/免责句后置)检查、单元润色与漂移核对、盲审隐匿、对照学校规范逐项终检;评阅意见整理、逐条回复、修改说明与修改审查表(仅评阅书也可先建台账)。Beamer 答辩稿用…
bahayonghang/academic-writing-skills
English LaTeX assistant for existing .tex journal or conference papers. Use for compile repair, venue formatting, bibliography/citation checks, section writing, logic, related work, tables, pseudocode, de-AI polish,…
ndpvt-web/latex-document-skill
Universal LaTeX document skill: create, compile, and convert any document to professional PDF with PNG previews. Supports resumes, reports, cover letters, invoices, academic papers, theses/dissertations, academic CVs,…
ndpvt-web/latex-document-skill
Universal LaTeX document skill: create, compile, and convert any document to professional PDF with PNG previews. Supports resumes, reports, cover letters, invoices, academic papers, theses/dissertations, academic CVs,…
Questions about industrial-ai-research
What does the industrial-ai-research skill do?
Is industrial-ai-research safe to install?
What can industrial-ai-research access on my machine?
Which assistants does industrial-ai-research work with?
How current is this page?
Sources
- github.com/bahayonghang/academic-writing-skills — the audited source at commit da871dac3b12 and every finding aboveObserved · 22 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the industrial-ai-research skill do?
- Is industrial-ai-research safe to install?
- What can industrial-ai-research access on my machine?