Kindle Clip CLI

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:33 PM UTC
• Version: 1.1.0

Overview

This skill has a coherent Kindle-notes purpose, but its install path asks users to trust mutable, unverified external code that will handle private reading data.

Install only if you are comfortable trusting the external kindle-clip project and its release channel with your Kindle clippings. Prefer a pinned source build or verified release, install into a user-owned directory, avoid curl-piped shell installers, and review any exported notes before saving or sending them to services like Telegram.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.md:18

Finding

Mutable Remote Installer Is Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:18-19 and INSTALL.md:187-188
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code at INSTALL.md:18-19:

bash

curl -fsSL https://raw.githubusercontent.com/emersonding/kindle-clip-processor/master/scripts/install-kindle-clip.sh \
  | KINDLE_CLIP_REPO=emersonding/kindle-clip-processor sh

Repeated update command at INSTALL.md:187-188:

bash

curl -fsSL https://raw.githubusercontent.com/emersonding/kindle-clip-processor/master/scripts/install-kindle-clip.sh \
  | KINDLE_CLIP_REPO=emersonding/kindle-clip-processor sh

Technical Analysis

The installation guide pipes an HTTP response directly into sh. The requested script comes from the mutable master branch of a personal GitHub repository rather than an immutable commit or cryptographically verified release.

The downloaded installer is not included in the audited Skill bundle. Consequently, its effective behavior cannot be reviewed from this project and can change after publication or audit. No checksum, digital signature, commit pin, content inspection, or release attestation is required before execution.

This is not necessary for the Skill's declared local parsing functionality. A user-scoped, version-pinned binary or an audited source build would provide the required functionality without creating a mutable remote code-execution channel.

Attack Path

1. An attacker compromises the repository owner account, modifies the master branch, or otherwise gains control over the installer response.
2. The attacker adds arbitrary shell commands to install-kindle-clip.sh.
3. A user or AI Agent follows the recommended installation or update command.
4. curl retrieves the attacker-controlled response.
5. The pipeline passes the response directly to sh without verification or inspection.
6. The attacker's commands execute with ...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both curl | sh commands from the installation and update instructions.
2. Pin downloads to a specific immutable release version and commit rather than master or “latest.”
3. Download the installer or artifact to a local file instead of executing the network response:

   bash

   curl -fL -o install-kindle-clip.sh \
     https://raw.githubusercontent.com/emersonding/kindle-clip-processor/IMMUTABLE_COMMIT/scripts/install-kindle-clip.sh
   

4. Publish an expected SHA-256 digest through a separately protected release channel and verify it before execution:

   bash

   echo "EXPECTED_SHA256  install-kindle-clip.sh" | sha256sum --check -
   

5. Sign release artifacts and verify signatures using a documented maintainer key or a provenance system such as Sigstore.
6. Require users to inspect the downloaded script before explicitly invoking it.
7. Prefer an audited source build from a pinned tag or a reputable package registry with locked versions and verifiable provenance.
8. Keep installation user-scoped and avoid elevated privileges unless a user explicitly requests a system-wide installation.

T08 · Insecure Dependencies

Error

• Location: INSTALL.md:42

Finding

Unverified Executables Are Installed from Mutable External Sources

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md:42-59, SKILL.md:18-24, and skill.json:32-34
Vulnerability Type: Insecure external binary and package supply chain
Risk Level: High

Manual release installation at INSTALL.md:42-59:

markdown

### Option B: Manual Install from GitHub Releases

1. Go to https://github.com/emersonding/kindle-clip-processor/releases
2. Download the appropriate archive for your platform:
   - macOS Intel: `kindle-clip_VERSION_darwin_amd64.tar.gz`
   - macOS Apple Silicon: `kindle-clip_VERSION_darwin_arm64.tar.gz`
   - Linux: `kindle-clip_VERSION_linux_amd64.tar.gz` or `kindle-clip_VERSION_linux_arm64.tar.gz`
   - Windows: `kindle-clip_VERSION_windows_amd64.zip` or `kindle-clip_VERSION_windows_arm64.zip`
3. Extract the archive
4. Move the `kindle-clip` binary to a directory in your PATH:
   ```bash
   # macOS/Linux
   sudo mv kindle-clip /usr/local/bin/

   # Or to user directory (no sudo needed)
   mkdir -p ~/.local/bin
   mv kindle-clip ~/.local/bin/
   export PATH="$HOME/.local/bin:$PATH"
   ```

Recommended installation at SKILL.md:18-24:

markdown

### Recommended: Manual Install (macOS/Linux)

1. Download the latest binary for your platform from [GitHub Releases](https://github.com/emersonding/kindle-clip-processor/releases).
2. Make it executable: `chmod +x kindle-clip`
3. Move `kindle-clip` to a directory in your PATH (e.g., `~/bin` or `/usr/local/bin`):
   ```bash
   mv kindle-clip /usr/local/bin/kindle-clip
   ```

Alternative package source at skill.json:32-34:

json

"requires_installation": true,
"installation_url": "https://github.com/emersonding/kindle-clip-processor",
"quick_install": "brew install emersonding/tap/kindle-clip-processor",

Technical Analysis

The Skill directs users to install a prebuilt executable from an external personal repository or a personal Homebrew tap. It doe ...[truncated 2187 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an exact release version and use immutable artifact URLs.
2. Publish SHA-256 checksums for every supported platform and require verification before extraction or execution.
3. Cryptographically sign release manifests and artifacts, and document signature verification.
4. Publish build provenance and reproducible-build instructions so users can compare locally built artifacts with releases.
5. Pin Homebrew formulas to reviewed versions and verified hashes; prefer a well-governed package source over an unaudited personal tap.
6. Include or vendor the relevant source in the audited package where practical.
7. Default to ~/.local/bin or another user-owned directory. Do not recommend sudo for ordinary use.
8. Make all installation documents and metadata consistent so they do not silently expand the set of trusted distribution channels.
9. Document the executable's expected filesystem and network behavior and provide a way to run it with outbound network access disabled.

other

Warning

• Location: RECIPES.md:5

Finding

Optional Recipe Transmits Personal Reading Data to Telegram Without a Confirmation Gate

Content

View full analysis

Vulnerability Details

File Location: RECIPES.md:5-11
Vulnerability Type: Sensitive data transmission to an external messaging service
Risk Level: Medium

Vulnerable workflow:

bash

## 1. Kindle → Summarize → Telegram
Keep your reading notes actionable by summarizing them and sending them to your telegram immediately.

```bash
# Example chain (using OpenClaw)
kindle-clip search "philosophy" --export-md ./temp.md
summarize ./temp.md --length short > ./summary.md
message send --channel telegram --message "$(cat ./summary.md)"

text

### Technical Analysis

The recipe exports data derived from the user's Kindle highlights to a plaintext temporary file, processes it through another tool, and sends the resulting content to Telegram. External transmission is unrelated to the Skill's minimum required local parsing, searching, filtering, and export functionality.

The workflow does not require explicit user confirmation immediately before transmission, identify the destination account or chat, display the outgoing content, provide redaction guidance, or warn about third-party retention. The generic filename `temp.md` also persists source material in the current directory rather than using a securely created temporary file.

This finding does not establish that Telegram transmission occurs automatically when the Skill is merely loaded. The risk arises when an Agent or user follows the documented optional recipe.

### Attack Path

1. A user or Agent follows the recipe to search private Kindle notes.
2. Matching notes are written in plaintext to `./temp.md`.
3. A separate summarization tool reads the exported notes and writes `./summary.md`.
4. The messaging command reads the summary through command substitution.
5. The content is sent to whichever Telegram destination is configured for the messaging tool.
6. If the destination is incorrect, shared, or compromised, personal reading information is dis
...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

1. Clearly label Telegram delivery as an optional third-party data transfer rather than part of the core local workflow.
2. Require explicit user approval immediately before sending any content.
3. Display the resolved recipient or chat and a preview of the exact outgoing message.
4. Allow the user to redact or exclude sensitive highlights and metadata.
5. Explain that Telegram and any summarization service may have independent privacy, retention, and access policies.
6. Avoid predictable plaintext files. Use a securely created temporary directory with restrictive permissions.
7. Delete temporary source and summary files after confirmed completion, while warning that secure deletion may not be guaranteed on all filesystems.
8. Prefer an in-memory pipeline where supported, without placing private source content in command-line arguments or persistent working-directory files.
9. Do not permit an Agent to send the message solely because it generated a summary; treat generation and external transmission as separate consent boundaries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 199)May include surrounding context.

bash

# Remove binary
rm ~/.local/bin/kindle-clip
# or
sudo rm /usr/local/bin/kindle-clip

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 201)May include surrounding context.

md

# Remove binary
rm ~/.local/bin/kindle-clip
# or
sudo rm /usr/local/bin/kindle-clip

# Remove config (optional)
rm -rf ~/.config/kindle-clip

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using rm -rf in documentation increases the risk of catastrophic user error because recursive forced deletion is unforgiving and often copied blindly. Even though the intended target is a specific config directory, a malformed home expansion, typo, or edited path could permanently remove additional user data.

Content

Scanner excerpt · INSTALL.md (reported line 204)May include surrounding context.

sudo rm /usr/local/bin/kindle-clip

Remove config (optional)

rm -rf ~/.config/kindle-clip

text

To remove the OpenClaw skill:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using rm -rf in documentation increases the risk of catastrophic user error because recursive forced deletion is unforgiving and often copied blindly. Even though the intended target is a specific config directory, a malformed home expansion, typo, or edited path could permanently remove additional user data.

Content

Scanner excerpt · INSTALL.md (reported line 204)May include surrounding context.

sudo rm /usr/local/bin/kindle-clip

Remove config (optional)

rm -rf ~/.config/kindle-clip

text

To remove the OpenClaw skill:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The recursive deletion of a skill directory is legitimate for uninstall, but the placeholder absolute path combined with rm -rf makes copy-paste mistakes more likely and could delete the wrong directory tree. In agent skill ecosystems, users may execute such instructions mechanically, increasing the practical risk.

Content

Scanner excerpt · INSTALL.md (reported line 210)May include surrounding context.

To remove the OpenClaw skill:

bash

rm -rf /path/to/openclaw/skills/kindle-clip

Next Steps

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The recursive deletion of a skill directory is legitimate for uninstall, but the placeholder absolute path combined with rm -rf makes copy-paste mistakes more likely and could delete the wrong directory tree. In agent skill ecosystems, users may execute such instructions mechanically, increasing the practical risk.

Content

Scanner excerpt · INSTALL.md (reported line 210)May include surrounding context.

To remove the OpenClaw skill:

bash

rm -rf /path/to/openclaw/skills/kindle-clip

Next Steps

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples explicitly instruct an agent to export Kindle highlights to local markdown files, which creates new persisted copies of potentially sensitive personal reading history, notes, and quotations. While writing to a user-requested local file is not inherently malicious, the documentation normalizes data export without reminding the agent to confirm file creation, choose an appropriate destination, or warn about the sensitivity of the resulting file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide instructs users to pipe a remotely fetched script directly into sh, which executes unreviewed network content immediately. If the script source, repository, or network path is compromised, users could run arbitrary code on their system without an opportunity to inspect it first.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 32)May include surrounding context.

If you get "command not found", add ~/.local/bin to your PATH:

bash

# For bash users (add to ~/.bashrc or ~/.bash_profile)
export PATH="$HOME/.local/bin:$PATH"

# For zsh users (add to ~/.zshrc)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 35)May include surrounding context.

md

# For bash users (add to ~/.bashrc or ~/.bash_profile)
export PATH="$HOME/.local/bin:$PATH"

# For zsh users (add to ~/.zshrc)
export PATH="$HOME/.local/bin:$PATH"

# Then reload your shell

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 54)May include surrounding context.

4. Move the kindle-clip binary to a directory in your PATH:

   bash

   # macOS/Linux
   sudo mv kindle-clip /usr/local/bin/
   
   # Or to user directory (no sudo needed)
   mkdir -p ~/.local/bin
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 70)May include surrounding context.

4. Move the kindle-clip binary to a directory in your PATH:

   bash

   # macOS/Linux
   sudo mv kindle-clip /usr/local/bin/
   
   # Or to user directory (no sudo needed)
   mkdir -p ~/.local/bin
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 56)May include surrounding context.

md

# macOS/Linux
   sudo mv kindle-clip /usr/local/bin/

   # Or to user directory (no sudo needed)
   mkdir -p ~/.local/bin
   mv kindle-clip ~/.local/bin/
   export PATH="$HOME/.local/bin:$PATH"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 201)May include surrounding context.

md

# macOS/Linux
   sudo mv kindle-clip /usr/local/bin/

   # Or to user directory (no sudo needed)
   mkdir -p ~/.local/bin
   mv kindle-clip ~/.local/bin/
   export PATH="$HOME/.local/bin:$PATH"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 57)May include surrounding context.

sudo mv kindle-clip /usr/local/bin/

Or to user directory (no sudo needed)

mkdir -p ~/.local/bin mv kindle-clip ~/.local/bin/ export PATH="$HOME/.local/bin:$PATH"

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The uninstallation section includes destructive rm -rf commands with no warning that deletion is permanent and path-sensitive. Users may copy, adapt, or parameterize these commands incorrectly and irreversibly delete unintended files or directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The recipe explicitly exports reading notes, summarizes them, and sends the result to Telegram, which is an external third-party service. Even though this is presented as an intentional workflow, the lack of any warning about data leaving the local environment can cause users to transmit sensitive highlights, notes, or personal information without realizing the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends using --export-md and repeatedly demonstrates writing Kindle highlights and notes to local files, but it does not warn that these outputs may contain sensitive personal reading history, annotations, or research notes. In an agent context, this can normalize persisting private user data to disk without clear consent, increasing the risk of unintended retention, later disclosure, or collection by other local tools and backups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The setup example stores a default Kindle path for future commands, which persists information about the user's filesystem layout and reading-data location. This is low severity in context, but agents following the example may save location data without making the persistence behavior clear to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes examples using --export-md to write Kindle highlights and notes to ./output.md and ./results.md, which affects user data on disk. The README does not include any warning or disclosure about local file creation or that exported reading data may contain personal information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.