ClawHub
Back to skill

Security audit

Bookshelf

Security checks across malware telemetry and agentic risk

Overview

Bookshelf is a disclosed local reading tracker that saves and exports your book notes on your own machine.

Install only if you are comfortable with reading notes, reviews, reminders, and exports being stored as local plain-text files under ~/.local/share/bookshelf. Avoid entering highly sensitive personal information, and protect or delete that directory if you share the device or sync home-directory files to backups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The script persistently stores all user-provided entries under ~/.local/share/bookshelf without clearly warning users that their free-form input will be written to disk. Because these entries may contain sensitive notes, reading habits, plans, or personal reflections, silent persistence increases privacy risk and can expose data to other local processes, backups, or users with filesystem access.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The export feature aggregates all logged activity into json, csv, or txt files on disk, again without an explicit privacy warning or confirmation. Exporting consolidated history makes data easier to exfiltrate, share accidentally, or ingest by other tools, especially since free-form values are copied verbatim into broadly readable formats.

Session Persistence

Medium
Category
Rogue Agent
Content
### Review, report, and archive

```bash
# Write a book review
bookshelf review "Atomic Habits — 5/5. Best takeaway: habit stacking. Changed my morning routine."

# Weekly reading review
Confidence
72% confidence
Finding
Write a book review bookshelf review "Atomic Habits — 5/5. Best takeaway: habit stacking. Changed my morning routine." # Weekly reading review bookshelf weekly-review "Week 15: finished Atomic Habits

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.