book-learning-tutor

• Outcome: Review
• Latest audit: Aug 11, 2026 · 5:27 AM UTC
• Version: 0.1.3

Overview

The skill is mostly a disclosed book-tutoring tool, but its optional acquisition path can run untrusted source rules through local JavaScript and broad network fetching with weak safeguards.

Install only if you plan to use the local book-processing tutor or you are comfortable reviewing the optional crawler/source-rule tools. Keep online acquisition disabled unless you explicitly need it, avoid importing untrusted source subscriptions, review or disable the JavaScript bridge, change HTTPS verification to on, and periodically review or delete the storage/ learner-profile files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs use of file I/O, shell execution, environment-dependent tooling, and optional network fetching, but it does not declare permissions or clearly constrain them in a machine-readable way. That creates a trust gap where a host or reviewer may underestimate the skill's effective authority, increasing the chance of unintended file access, command execution, or network use.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The README makes a strong safety claim that the external skill path does not perform network crawling or proxying, yet elsewhere exposes externally invocable commands that do exactly that (`search`, `download`, `import_source`, `discover`). This mismatch can mislead users or downstream agents into invoking network-capable features under a false assumption of local-only behavior, weakening security expectations and consent boundaries.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The skill requires automatic end-of-session writes to several persistent files, including progress, review cards, memorization notes, and user habits/preferences. Even if intended for normal tutoring state management, undisclosed persistent storage expands the skill's data-handling surface and can surprise users, creating privacy and integrity risks if sensitive study behavior or preferences are stored without explicit awareness.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This research utility handles JS-source extraction and writes out candidate source data plus antivirus whitelist domains, which is outside the declared tutoring-only scope of the skill. The comments explicitly discuss reverse-engineering site JS/XHR behavior and preparing AV exceptions, which increases the risk that the package facilitates acquisition from external sources in a way users and reviewers would not expect.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Generating a file of domains for antivirus whitelisting is security-sensitive because it assists users in weakening endpoint protections for a set of external hosts the tool intends to contact. In the context of a book-learning tutor, this is especially mismatched and could normalize bypassing security controls to access potentially untrusted content sources.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements a standalone network source import, probing, caching, and verification workflow for third-party book-source subscriptions, including arbitrary URL fetching and persistence into the skill’s source pool. That materially expands capability beyond tutoring a user-provided local book or fetching a specific public source with explicit user authorization, creating a pathway to ingest untrusted remote sources and persist them for later use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file is explicitly designed to evaluate third-party rule fragments such as @js: and {{java.*}} inside a long-lived local Node process. In the context of a book-learning tutor, this is a dangerous overreach: untrusted content can drive arbitrary JavaScript execution locally, potentially enabling data access, process abuse, or pivoting through any dangerous objects exposed by the runtime shim.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest suggests network use is limited to user-authorized public-book retrieval, but the implementation prefetches URLs embedded in third-party JavaScript rules via java.ajax. That creates a capability mismatch: hostile or untrusted rules can induce arbitrary outbound requests, exposing IP/address metadata, probing internal services, or contacting unexpected domains without clear user intent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The _rmtree_force function explicitly bypasses local safe-delete protections and uses low-level deletion APIs to remove directory trees. If an attacker can influence the target path, or if path resolution/symlink assumptions fail, this can destroy arbitrary files and defeat host safety controls that were intended to prevent destructive actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The module claims to be a pure parsing interpreter that skips browser-bridge actions, but the implementation later invokes `_JS_BRIDGE.eval(...)` on attacker-controlled `@js:` and `<js>` rules. In this skill, book-source JSON may come from network-retrieved public sources, so untrusted rule content can trigger real JavaScript execution inside the bridge environment, creating a code-injection boundary and undermining the documented trust model.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The comments state that JS handling is limited to static `result.replace`-style rewrites and that `java.*` browser-bridge actions are skipped, but `__evaluate_single` actually performs full bridge evaluation whenever `_JS_BRIDGE` is present. This mismatch is dangerous because developers or downstream callers may treat book-source rules as data rather than executable code, increasing the chance that malicious remote rules are accepted and run.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The loader accepts arbitrary HTTP/HTTPS URLs for book-source definitions and fetches them without any trust boundary or allowlist. Because those source definitions control later scraping behavior, this expands the skill from local-book tutoring into remote content acquisition and can expose the agent to untrusted rule files, hostile endpoints, and policy-bypassing data retrieval.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The engine stores raw HTTP responses under repository-controlled debug paths and downloaded books under a persistent reference directory. Persisting untrusted remote content increases the blast radius of SSRF-like fetches, sensitive-data retention, copyright-sensitive content caching, and disk-consumption abuse, especially when the skill is supposed to primarily teach from user-provided local books.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code initializes a Node-based JS bridge and later evaluates JavaScript fragments from external book-source rules such as {{java.*}} and @js fields. Executing attacker-controlled script from remotely loaded source definitions is a major code-injection risk: even if intended as a compatibility layer, it can enable arbitrary computation, unexpected network activity, sandbox escape attempts, or abuse of bridge-exposed capabilities.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase "help me learn X" is overly broad and can activate the skill for many general educational requests that are not book-specific. In practice this can cause the agent to load a high-capability skill unexpectedly, expanding access to files, shell commands, and network acquisition in contexts where the user did not intend to invoke this tool.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill mixes a book-processing workflow with a fallback mode for open-ended topic learning, making activation boundaries unclear. Ambiguous routing increases the risk that common study requests invoke a workflow with unnecessary file, shell, or acquisition capabilities, which is a security and least-privilege concern.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions mandate writing multiple user data files at session end without any visible requirement to notify the user or obtain consent for modifying stored notes, review cards, and preference/history files. This is dangerous because it can silently accumulate personal learning data and create unexpected persistence that affects future sessions or exposes sensitive habits if the storage is later accessed.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file explicitly states that a cross-book, user-specific learning profile is automatically updated after each chapter, but it provides no notice, consent flow, retention policy, or user control over that persistent storage. This creates a privacy risk because behavioral and preference data can accumulate silently across sessions and books, enabling profiling beyond what a user may reasonably expect from a tutoring skill.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code silently launches a background Node worker to process rule code, but the skill description does not clearly disclose local subprocess execution to the user. In a user-facing agent skill, hidden execution of an auxiliary runtime increases trust and transparency risk, especially when paired with evaluation of externally sourced rule logic.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prefetch logic automatically issues fetches for literal URLs found inside evaluated expressions, without any user-facing notice or approval at the time of execution. In this skill context, that is dangerous because third-party parsing rules can trigger unexpected network access beyond the user’s apparent request, undermining consent and creating privacy and SSRF-like exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

>
> **Teacher:** 🔒 **Gate passed (≥80%).** Exactly — recognition is by touch/angle, not vision. That's why the social order (shape = class) is both rigid *and* invisible. **Must-memorize 📌:** *no "up" exists; sight shows only a line.*
>
> **📝 Homework:** write one sentence explaining why a Sphere visiting Flatland would be invisible until it intersects the plane. **🗣 Recite:** the penny analogy, from memory, next lesson.

`progress.json` ← lesson 1 marked `learned`, mastery 0.8; chat closed. Next session, *"continue Flatland"* resumes at lesson 2 and reviews lesson 1 first.

• Confidence: 82% confidence
• Finding: write one sentence explaining why a Sphere visiting Flatland would be invisible until it intersects the plane. **🗣 Recite:** the penny analogy, from memory, next lesson. `progress.json` ← lesson 1 ma

Self-Modification

High

• Category: Rogue Agent

Content

A rule effective 3 times in a row → mark ✅; no new suggestion 5 times in a row → mark 🔒, unless the user asks to stop changing.

## 4. Decision tree
Ignore transient issues; reusable → buffer → observe → generality check → write SKILL.md / write 习惯.md → mark → stable / frozen.

## 5. Knowledge-base auto-maintenance (must do at session end)
1. Update progress (skip if progress.json already written back).

• Confidence: 96% confidence
• Finding: write SKILL

Known Vulnerable Dependency: curl_cffi==0.10 — 2 advisory(ies): CVE-2026-33752 (curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (wi); CVE-2026-33752 (curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (wi)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: curl_cffi==0.10

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

class Fetcher:
    def __init__(self, proxy=None, timeout=20, delay=0.0, http2=True, verify=False,
                 ua_mode="desktop", rate_limiter=None):
        """
        proxy: "http://host:port" 或 None

• Confidence: 99% confidence
• Finding: verify=False

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/acquire/js_bridge.py:262

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/acquire/js_runtime.js:177

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: tools/acquire/fetcher.py:162