Hardcover.app skill for tracking books you're reading, reading goal, and finding books you'd love to read

• Analyzed: May 12, 2026, 3:22 AM
• Findings: 0
• Version: 1.0.7
• Hash: 4d3dc66df5cd0b17a26c67b5d94a64afda80166292d2c1427e04567ae019c42c
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: hardcover Version: 1.0.7 The OpenClaw AgentSkills skill bundle for Hardcover.app is benign. It clearly defines its purpose as querying the Hardcover.app GraphQL API, requiring a `HARDCOVER_API_TOKEN` for authentication. The `SKILL.md` provides standard API usage instructions, including a `curl` example that interacts solely with `https://api.hardcover.app/v1/graphql` using the specified token. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. All provided GraphQL queries are read-only, fetching book and user data, which aligns perfectly with the skill's description.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Installing or using the skill means the agent can use your Hardcover token to read account-linked Hardcover data that the token is authorized to access.

Why it was flagged

The skill requires a Hardcover API token and uses it as a bearer credential for authenticated account access.

Skill content

- **Env variable:** `HARDCOVER_API_TOKEN` from https://hardcover.app/settings
...
All queries require `Authorization: Bearer {token}` header

Recommendation

Use a token you are comfortable granting to the agent, revoke it if no longer needed, and avoid sharing outputs that contain private reading history or notes.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Your reading lists, progress, ratings, reviews, or goals could be copied into another destination if you ask the agent to sync them.

Why it was flagged

The skill may retrieve Hardcover data for use in another system, which is purpose-aligned but creates a data-sharing boundary the user should notice.

Skill content

Also use for syncing reading data to other systems (Obsidian, etc.)

Recommendation

Confirm the destination and scope before syncing, especially for private reviews, reading journals, or lists.