每日潜力网文新书推荐-SBTI版！

• Outcome: Review
• Latest audit: May 28, 2026 · 1:47 AM UTC
• Version: 1.0.5

Overview

The skill is mostly a coherent Qidian book recommender, but it can automatically install unpinned Python packages during normal use, so it needs review before installation.

Install only if you are comfortable with the skill running local Python scripts that may contact qidiantu.com/Qidian, write cache/history files, preserve attribution tags in links, and automatically install Python packages. Prefer using an isolated virtual environment and preinstalling reviewed, pinned dependencies instead of allowing runtime pip installs.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for cmd in pip_commands:
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
            if result.returncode == 0:
                print(f"[OK] 依赖安装成功: {', '.join(pip_packages)}", file=sys.stderr)
                return True

• Confidence: 95% confidence
• Finding: This code automatically invokes pip to install packages at runtime, which modifies the execution environment and executes package installation logic from external repositories. In a skill whose purpose is book recommendation, this is unnecessary privilege expansion and creates supply-chain and policy-bypass risk if package indexes, mirrors, or resolution are tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("[ERROR] 需要 openpyxl 库。安装: pip3 install openpyxl", file=sys.stderr)
        try:
            subprocess.run([sys.executable, "-m", "pip", "install", "openpyxl"],
                          capture_output=True, timeout=60)
            import openpyxl
        except Exception:

• Confidence: 95% confidence
• Finding: The Excel import path also installs openpyxl on demand via pip subprocess, again allowing runtime environment mutation and introducing external package execution into a content-recommendation skill. Even though the command arguments are fixed, this still increases attack surface through dependency confusion, compromised mirrors, or unauthorized package installation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            if verbose:
                print(f"[INFO] 尝试: {' '.join(cmd)}", file=sys.stderr)
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
            if result.returncode == 0:
                print(f"[OK] 依赖安装成功: {', '.join(pip_packages)}", file=sys.stderr)
                installed = True

• Confidence: 96% confidence
• Finding: The script automatically installs Python packages by spawning pip during normal operation, which gives a book-recommendation skill unnecessary code-execution and environment-modification capability. Even though the package list is hardcoded, this still expands the trust boundary to package indexes, mirrors, local pip config, and the executing environment, making supply-chain compromise or unintended package installation materially dangerous.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The documentation requires preserving a tracking parameter in outbound links and mentions enterprise push workflows, neither of which is clearly disclosed in the skill's declared purpose. Hidden attribution and downstream message distribution expand data-handling and privacy implications in ways users may not expect from a simple recommendation skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill documents creation of scheduled automation tasks, which is a persistent action beyond one-off book recommendations. Persistence and autonomous execution increase risk because they can repeatedly trigger network access, file writes, or outbound content generation without fresh user review.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic dependency installation is especially risky in a low-risk domain like book recommendation because it introduces code execution and supply-chain exposure unrelated to the core user need. A skill that can invoke pip can fetch and execute third-party packages, making compromise or abuse significantly more severe than the apparent business purpose suggests.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Auto-installing Python packages exceeds the expected capability of this skill and violates least privilege by turning a recommendation script into an environment-modifying installer. In managed agent environments, such behavior can bypass operational controls, create persistence, and expose the system to supply-chain compromise from package sources.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The optional Excel workflow still performs package installation during normal execution paths, which is unrelated to serving recommendations and broadens the skill's permissions. Because this occurs conditionally based on feature use, it may be overlooked in review while still enabling unapproved code retrieval and execution from package infrastructure.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Auto-installing dependencies via pip is not justified by the skill’s stated purpose and introduces a meaningful supply-chain and execution risk. In this context, a recommendation skill should not be modifying the host environment or fetching executable packages at runtime, especially when triggered as part of an agent workflow.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests like 'recommend a good book' or 'what should I read today,' which can cause over-invocation of a skill that has network, shell, and file capabilities. Overbroad routing increases the chance that users are funneled into a more privileged workflow than necessary for the request.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill mandates a `_trace` attribution parameter in outbound links but does not present a user-facing warning that recommendations include tracking for referral attribution. This is a transparency and privacy problem because users may click links without understanding that traffic source tagging is being preserved intentionally.

Static analysis

No suspicious patterns detected.