Security audit

Bookify - Convert Markdown to PDF or EPUB

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Markdown-to-PDF/EPUB conversion skill, with ordinary npm execution risks but no evidence of hidden or malicious behavior.

Install only if you are comfortable letting the agent run npx-based document conversion tools on selected Markdown files. Prefer trusted workspaces, avoid converting attacker-controlled filenames or metadata without validation, and review npm/Puppeteer supply-chain exposure if using this in sensitive environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Runtime Download and Execution of Unverified npm Dependencies
Content: View full analysis
[options] ``` ### Technical Analysis The permitted commands use `npx` to obtain and immediately execute code from the configured npm registry. Although `md-bookify` is pinned to version `2.2.1`, the Skill provides no lockfile, vendored dependency set, package-integrity verification, or other mechanism that verifies the package and its transitive dependency graph before execution. The Puppeteer command is less deterministic because `@24` selects a mutable major-version range rather than one exact reviewed release. Different executions can therefore resolve to different package versions. The browser-installation command also downloads an additional executable artifact. This creates a supply-chain trust boundary in which code not contained in the audited project executes with the Agent process's operating-system permissions. The package version shown in the command reduces version drift for `md-bookify`, but it does not eliminate registry compromise, compromised releases, malicious lifecycle behavior, or risks in unresolved transitive dependencies. ### Attack Path 1. A user asks the Agent to convert a Markdown document or resolve the documented missing-Chromium condition. 2. The Agent invokes one of the permitted `npx` commands. 3. `npx` resolves and, when not already available locally, downloads the package and its dependencies from the configured npm registry. 4. A compromised package release, registry response, or transitive dependency supplies malicious code. 5. npm lifecycle code or package runtime code executes local ...[truncated 669 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:20
Finding: Unsafe Shell Command Construction Guidance for User-Controlled Arguments
Content: View full analysis
[options] ``` ``` Additional examples repeat unquoted path operands: ```bash npx md-bookify@2.2.1 README.md npx md-bookify@2.2.1 report.md -s elegant --author "Jane Doe" -o output/report.pdf npx md-bookify@2.2.1 data.md -f Letter --landscape ``` ### Technical Analysis The Skill directs the Agent to derive file paths, formats, and metadata from user-controlled `$ARGUMENTS`, then place those values into Bash command templates. It does not require shell-safe quoting, strict validation, canonicalization, or separation of options from positional file paths. If an implementation interpolates a user-supplied value directly into the shell command, shell metacharacters such as command separators or substitutions may be interpreted by Bash rather than passed as literal data. A filename beginning with `-` may also be interpreted as a command-line option where the utility supports no explicit end-of-options separator. This is especially relevant because the `allowed-tools` rule permits a broad suffix after `npx md-bookify@2.2.1`. Consequently, it does not independently constrain the generated argument string to a safe set of paths and options. Exploitation depends on the Agent constructing a command through literal shell interpolation. The document does not itself contain a fixed malicious payload, but it omits the safeguards necessary to prevent ...[truncated 1420 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: MCP server references in the skill manifest without version pinning are a rug-pull risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: MCP server references in the skill manifest without version pinning are a rug-pull risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown explicitly states that the EPUB --language option defaults to en. This imposes a specific locale by default and does not mention prompting the user or allowing an explicit language choice, which can conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.