libby-book-monitor

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Libby/OverDrive catalog monitor that stores a local watchlist and queries a public API, with install and automation caveats users should understand.

Install from a reviewed tag or pinned installer when possible, and expect the skill to write watchlist/config JSON under `~/.libby-book-monitor/` unless you choose another data directory. Only set up the documented cron or notification examples if you want recurring checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned npm Package Is Downloaded and Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:19
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add alexpolonsky/agent-skill-libby-book-monitor

Technical Analysis

The recommended installation command invokes the skills npm package through npx without specifying an exact version or integrity value. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute its command.

Consequently, the code executed during installation is not fully represented by, or immutable with respect to, the audited project. A future package update, registry-account compromise, package takeover, or compromised dependency could alter installation behavior after this Skill has been reviewed. This is a supply-chain exposure rather than evidence that the current skills package is malicious.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a dependency used by the package that provides the skills command.
2. The attacker publishes a modified version containing malicious installation or runtime behavior.
3. A user follows the documented unpinned npx skills add ... command.
4. npx resolves and downloads the mutable package version from the configured registry.
5. The downloaded package executes with the privileges of the user running the installation command.
6. Malicious code could then access, alter, or exfiltrate resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include that user's files, environment variables, agent configuration, developer credentials, and network permissions. It would not inherently grant administrator or root privileges unless the command were run with elevated privileges or anoth ...[truncated 298 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to an exact reviewed version:

   bash

   npx skills@<exact-reviewed-version> add alexpolonsky/agent-skill-libby-book-monitor
   

2. Avoid floating tags such as latest, version ranges, or unspecified versions.
3. Document the expected package publisher, registry, version, and integrity information so users can verify the retrieved artifact.
4. Prefer installation from a reviewed repository tag or commit hash where practical, and document commit verification.
5. Recommend running installation without administrator privileges and in an isolated environment when possible.
6. Periodically review and update the pinned version only after auditing the package and its dependency changes.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

Use --notify to only get output when something new appears - perfect for scheduled checks:

bash

# crontab -e
0 9 * * * /usr/bin/python3 /path/to/scripts/libby-book-monitor.py check --notify

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable commands that use Python, persistent storage, environment-controlled paths, and remote API access, but the manifest does not declare any explicit tool scope or permissions boundaries. This creates a transparency and least-privilege problem: a host agent may invoke a skill with broader file, network, or environment access than the user expects, increasing the chance of unintended data access or network activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description contains broad trigger phrases such as "book available," "overdrive," and generic library-related terms, which may cause the skill to activate during ordinary conversation unrelated to this specific tool. Over-broad activation can lead to unintended execution of a networked, stateful skill that reads or writes watchlist data, surprising users and increasing the risk of unnecessary external queries or profile/data modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.