ClawHub
Back to skill

Security audit

If Book Could Speak

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video-generation purpose is coherent, but it should be reviewed because it recommends persistent agent configuration changes, plaintext API-key storage, and unverified package/media downloads.

Install only after reviewing the setup commands. Prefer a virtual environment with pinned dependencies, verify or vendor the audio assets, avoid storing the TTS key in plaintext when possible, and if a file key is used, restrict it to owner-only permissions. Treat the Codex config edit as a global persistent change and make it manually only if you want skills enabled there.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:74
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:94
Finding

TTS API Key Stored Persistently in a Plaintext File

Content
View full analysis
~/.workbuddy/skills/if-book-could-speak/.tts_key ``` ### Technical Analysis The recommended configuration writes a reusable TTS API key directly into a plaintext file. The command does not explicitly create the file with restrictive permissions or verify the user's `umask`. Depending on the local permission configuration, the credential may be readable by other local users or processes. It may also be exposed through backups, diagnostic archives, directory synchronization, or accidental inclusion when the skill directory is copied or distributed. Although the document warns users not to share the file, that warning does not provide technical access control or prevent accidental disclosure. ### Attack Path 1. A user replaces the placeholder with a valid TTS API key and executes the documented command. 2. The shell creates `.tts_key` using permissions derived from the current `umask`. 3. Another local process, user, backup service, synchronization tool, or packaging operation obtains access to the skill directory. 4. The plaintext key is read from `.tts_key`. 5. The exposed credential is used to make unauthorized requests against the victim's TTS account. ### Impact Assessment Exploitation exposes the TTS API credential and permits operations authorized by that key. Likely consequences include unauthorized API consumption, account quota exhaustion, financial charges, and service disruption. The finding does not establish operating-system privilege escalation; impact is primarily limited to the external service permissions granted to the compromised key. ]]>
Remediation
View remediation
~/.workbuddy/skills/if-book-could-speak/.tts_key chmod 600 ~/.workbuddy/skills/if-book-could-speak/.tts_key ``` - Validate ownership and permissions before reading the key. - Explicitly exclude `.tts_key` from version control, backups, exported skill archives, and diagnostic bundles. - Avoid printing the key in logs or command traces. - Use a narrowly scoped key where supported and document immediate rotation procedures for suspected exposure. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:116
Finding

External Media Downloaded from a Mutable Branch Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Referencing and appending to ~/.codex/config.toml targets a sensitive agent configuration location. Even though the intent appears to be setup guidance, access to this path is security-relevant because it can alter agent behavior globally and persist beyond this skill's runtime.

Content

Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.

bash
# 1. 开启 Skills 功能
cat >> ~/.codex/config.toml << 'EOF'
[features]
skills = true
EOF

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
91% confidence
Finding

Referencing and appending to ~/.codex/config.toml targets a sensitive agent configuration location. Even though the intent appears to be setup guidance, access to this path is security-relevant because it can alter agent behavior globally and persist beyond this skill's runtime.

Content

Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.

bash
# 1. 开启 Skills 功能
cat >> ~/.codex/config.toml << 'EOF'
[features]
skills = true
EOF

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger list includes “做读书视频”, which is a generic request that could overlap with many ordinary book-video tasks beyond this specific skill. The description does not provide exclusion conditions or tighter scope to distinguish when this skill should activate versus other reading/video-generation skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The markdown states that the default voice is a Chinese female voice and that the user does not need to specify it, while the rest of the skill is presented as cross-platform rather than clearly region- or language-limited. This imposes a language/locale choice by default without offering the user an explicit opt-in or language selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

L131-L145 明确写的是“第三人称书评文案”且示例 JSON 的 content 字段也如此描述，但 L147-L150 又要求“全文使用第一人称，书自己是讲述者”。这不是单纯信息缺失，而是同一工作流说明内部对文案视角的直接矛盾，容易导致实现或调用时偏离预期。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

L165 将 cap 描述为“字幕文案（一句话，第三人称）”，但 L175-L180 立刻插入了“你好，我是《{book_name}》...”的第一人称开场白，且整个技能在 L013、L021、L480-L491 均强调第一人称书籍自述。该注释/文档与预期产物视角相冲突，属于意图与说明不一致。

Content

No source excerpt is available for this finding.