Security audit

Calibre Ebooks

Security checks for vulnerabilities and agentic risk

Overview

This Calibre library skill is partly coherent, but it hides state-changing queue actions and ships a persistent local service with broad download and credential-handling risks.

Review before installing. Use this only if you are comfortable running a persistent local Calibre gateway that can write queue state, access local library files, use API keys, and make outbound download requests. Require explicit consent before queueing missing books, remove the instruction to hide queue actions, restrict direct downloads to approved HTTPS hosts with size limits, avoid query-string API keys, and pin dependencies before deployment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:308
Finding: Persistent Agent Instruction Hijacking and Concealed Queue Actions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: calibre-openclaw-gateway/app/services/download_service.py:94
Finding: Server-Side Request Forgery Through Automatically Processed Download URLs
Content: View full analysis
bool: if download_url: try: response = requests.head(download_url, timeout=10, allow_redir ...[truncated 3747 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: calibre-openclaw-gateway/app/dashboard.html:2367
Finding: API Key Exposure Through WebSocket Query Strings and Persistent Browser Storage
Content: View full analysis
str: auth_header = websocket.headers.get("authorization", "") if auth_header.lower().startswith("bearer "): return auth_header[7:].strip() return ( websocket.headers.get("x-api-key", "").strip() or websocket.query_params.get("api_key", "").strip() ) ``` ### Technical Analysis Long-lived API credentials are stored in `localStorage`, where any JavaScript executing under the same origin can read them. This includes code introduced through a future cross-site scripting defect, compromised same-origin assets, or malicious browser extensions. The key is then added to the WebSocket query string. URLs are more likely than headers to appear in browser developer tools, reverse-proxy diagnostics, network monitoring systems, and operational logs. The dashboard also explicitly prints the full credential-bearing URL to the browser console. Although browsers cannot generally set arbitrary a ...[truncated 1262 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: calibre-openclaw-gateway/requirements.txt:1
Finding: Mutable and Unpinned Dependencies Permit Supply-Chain Code Substitution
Content: View full analysis
/dev/null ``` ### Technical Analysis None of the PyPI dependencies is pinned to a reviewed version. The final dependency is fetched directly from a Git repository without a commit identifier or content hash. Its effective content can therefore change after the Skill package has been reviewed. Python packages execute code during installation and later when imported by the persistent gateway service. If an upstream account, repository, release process, or package is compromised, a future installation may execute code that was not present during this audit. This is particularly significant because the installed application: - Reads database credentials and API keys from `.env`. - Accesses the Calibre library and download directories. - Makes outbound network requests. - Runs persistently through systemd when installed. No evidence was found that the listed packages are currently malicious. The vulnerability is the inability to reproduce or verify the reviewed depe ...[truncated 1464 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (345)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Uploading local files, queueing/downloading books from external sources, and exposing a generic arbitrary request capability allow far broader API interaction than the skill description suggests. A generic request primitive is especially risky because it can be used to reach mutating or unforeseen endpoints discovered at runtime.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: calibre-openclaw-gateway/app/dashboard.html:2367

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: calibre-openclaw-gateway/app/services/virus_service.py:19