Calibre Ebooks

• Outcome: Review
• Latest audit: Jun 20, 2026 · 7:56 PM UTC
• Version: 1.0.12

Overview

This skill is mostly a Calibre library integration, but it also contains under-disclosed external search, download, upload, scanning, and persistent background-service features that go beyond its local-library description.

Install only if you want a network-capable Calibre gateway, not just a local catalog helper. Before using it, set a strong API key, keep unauthenticated access disabled, review OpenLibrary/download-queue defaults, disable VirusTotal unless you accept third-party file submission, avoid exposing the API beyond localhost, and treat systemd workers and upload/download features as administrative capabilities that need explicit operational control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (78)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise Exception("Ollama model is missing and automatic model pull is disabled")
                self._log(f"Model {self.embedding_model} not found. Installing...", "WARN")
                self._show_progress(0, 1, "Installing model", self.embedding_model)
                install_result = subprocess.run(['ollama', 'pull', self.embedding_model], 
                                              capture_output=True, text=True)
                self._show_progress(1, 1, "Installing model", self.embedding_model)
                if install_result.returncode == 0:

• Confidence: 96% confidence
• Finding: install_result = subprocess.run(['ollama', 'pull', self.embedding_model], capture_output=True, text=True)

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: Recording missing books into a server-side download queue goes beyond local query/management and creates a workflow that can trigger later acquisition from external sources. This is risky because it may collect user interests, initiate unreviewed downstream downloads, and bypass expectations that the skill only operates on existing local content.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The attachment intake and import-queue workflow materially expands the attack surface from read/query operations to ingestion of untrusted files and persistent storage of user-supplied content. Even with a manual import step, this creates risks around malware, dangerous file parsing later in the pipeline, metadata abuse, and storage of potentially sensitive attachments outside the declared scope.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The README explicitly documents network-based metadata enrichment, public-domain download links, VirusTotal scanning, and background processing, which materially exceeds the stated skill scope of using local Calibre/Books API helpers only when needed. This scope expansion increases attack surface and creates data egress and remote-content ingestion paths that a user of a 'local library' skill would not reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Adding an ebook upload endpoint changes the trust and behavior model from querying/managing an existing local Calibre catalog to accepting new untrusted files into the environment. File ingestion introduces risks such as malicious document handling, unsafe file storage, and unintended modification of the local library beyond the advertised scope.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: Automatic downloading from OpenLibrary/Archive.org introduces remote code/content ingestion and persistent file creation on disk, which goes beyond a local-library management skill. Even if intended for public-domain books, automated remote downloads materially increase supply-chain, malicious file, and policy/scope risks.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Installing systemd services and scheduled workers extends the skill from API functionality into host-level persistence and service management. That broader capability can create unexpected long-running processes, startup persistence, and operational risk beyond what a local Calibre query skill implies.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The upload endpoint introduces arbitrary file-ingest and persistent write capability that is not reflected in the skill's stated purpose of managing/querying a local Calibre library. Even with extension and size checks, this materially expands the trust boundary by allowing remote users to place attacker-controlled content on disk, which can enable storage abuse, malicious ebook staging, or downstream exploitation in other Calibre or document-processing components.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The OpenLibrary enrichment and download-link routes add external network access and third-party data retrieval despite the manifest claiming local Calibre/RAG helpers only. This mismatch is dangerous because it creates undeclared data flows and outbound connectivity, which can violate operator expectations, privacy assumptions, and network-isolation policies for a supposedly local-only skill.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Optional VirusTotal scanning sends book bytes to an external service, introducing outbound content exfiltration capability unrelated to a strictly local library API. In this skill context, that is more dangerous because the manifest explicitly frames behavior as local-only, so operators may not anticipate that downloaded content can be transmitted off-host when a query flag is set.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This route adds arbitrary upload and storage capability beyond the expected query/management scope, substantially increasing attack surface. An attacker can use the service as a file-drop location for untrusted content, consume storage, and potentially seed files that later trigger vulnerable parsers, indexers, or conversion pipelines elsewhere in the application.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file exposes a broad download-management surface, including queueing, retrying, marking manual downloads, and matching files, which goes beyond the declared skill scope of managing/querying a local Calibre library. Scope expansion is dangerous because it creates an unauthorized capability boundary: an agent intended only for local library operations can be used to orchestrate acquisition and tracking workflows for external content.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code explicitly checks whether automatic download is available and then allows items to be queued for automatic acquisition, which is outside the justified behavior of a local Calibre library manager. Automatic acquisition materially increases risk because it enables the agent to initiate or facilitate retrieval of external content, potentially including unauthorized, unsafe, or policy-violating downloads.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This endpoint accepts arbitrary file paths and inspects the local filesystem to check existence, compute hashes, and derive file size, which exceeds the expected scope of a library query/management skill. Even without returning file contents, arbitrary path handling can leak metadata about local files and normalize a dangerous primitive for filesystem probing through the agent interface.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The endpoint silently expands a local-library search into a third-party OpenLibrary query, which violates the stated local-only scope and causes user search terms to leave the local environment. In a skill advertised as operating on a local Calibre library, this creates an unexpected data-flow boundary and can expose sensitive reading interests or internal search terms to an external service.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This dedicated endpoint exposes a pure external bibliographic search capability that exceeds the declared purpose of managing and querying a local Calibre library. Scope expansion matters in agent skills because downstream systems may trust the manifest to reason about where data goes; this endpoint breaks that trust and can leak user queries to a third party.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code injects remote OpenLibrary results into normal search results, blending local and external data in one response without strong disclosure. That can mislead callers about provenance and create privacy and trust issues, especially when the skill is expected to use local Calibre and local helpers only.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This worker performs network-driven book downloads and mutates persistent queue state, which exceeds the stated skill scope of managing/querying a local Calibre library through local helpers only when needed. Scope expansion is dangerous because it introduces remote content retrieval, external URL handling, and autonomous background actions that can be abused for unintended network access, ingestion of untrusted files, or policy bypass if queue items are attacker-controlled.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: A long-running background worker that continuously polls and processes a download queue creates autonomous capability not obviously required for local Calibre library management. In this skill context, that makes the component more dangerous because it can perform ongoing actions without direct user invocation, increasing the blast radius of any queue injection, misconfiguration, or abuse of the download path.

Context-Inappropriate Capability

Medium

• Confidence: 72% confidence
• Finding: The optional network-binding monitor and endpoint expose active interface URLs, which can disclose internal network topology and reachable addresses beyond what is needed for local Calibre management. In a service intended for local library operations, this increases attack-surface discovery and can aid lateral movement or targeting if the API is reachable by untrusted users.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: These models explicitly support download queueing and remote acquisition fields such as source, download_url, OpenLibrary IDs, and Archive identifiers, which exceeds the declared scope of a local Calibre-only management/query skill. That scope mismatch is dangerous because it can enable unreviewed network-enabled content retrieval, expanding the trust boundary and creating opportunities for SSRF, policy bypass, or ingestion of untrusted files elsewhere in the system.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The request model includes fields for remote source selection and direct download URLs even though the skill description says it should use local Calibre/RAG helpers only when needed. This mismatch makes the skill more dangerous in context because users and reviewers may assume it is local-only, while the exposed interface can drive remote content acquisition and downstream processing of attacker-controlled files.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: This worker can automatically select and queue random books for embedding generation when the explicit queue is empty, which goes beyond a strictly on-demand interpretation of the skill description. In a local library context this can cause unintended processing of book contents, increasing privacy and consent risk if users expected semantic indexing only for explicitly requested items.

Description-Behavior Mismatch

Medium

• Confidence: 76% confidence
• Finding: The reconciliation path can trigger library-wide embedding invalidation and reprocessing, which exceeds a narrowly scoped 'use RAG helpers only when needed' model. While not a code-execution issue, it can materially expand processing scope, causing unexpected bulk handling of local document contents and possible resource exhaustion or privacy surprises.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The service includes OpenLibrary enrichment and download-link retrieval, which introduces external network access and third-party data sharing into a skill described as using only local Calibre/RAG helpers unless explicitly needed. In this context, transmitting book metadata such as title, author, or ISBN to an outside service expands the trust boundary and can violate user expectations, privacy requirements, or deployment restrictions.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: calibre-openclaw-gateway/app/dashboard.html:2367

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: calibre-openclaw-gateway/app/services/virus_service.py:19