Security audit

book-learning-tutor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local book tutor, but its optional web-acquisition path can run untrusted source rules and make broad network requests, so it needs review before installation.

Install only if you plan to use the local-book workflow or can tolerate reviewing the optional acquisition path carefully. Avoid importing untrusted source subscriptions or running online acquisition until JavaScript evaluation is sandboxed or removed, TLS verification is enabled, and network destinations are restricted to confirmed public domains.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: tools/acquire/js_bridge.py:57
Finding: Remote Source Definitions Can Execute Unrestricted Node.js Code
Content: View full analysis
"): body = sel[4:] if sel.startswith("") else sel[len("@js:"):] if body.endswith(""): body = body[:-5] if _JS_BRIDGE is not None: try: res = _JS_BRIDGE.eval( body.strip(), result=_to_result(context), variables=getattr(_JS_BRIDGE, "variables", None), headers=getattr(_JS_BRIDGE, "headers", None), ) return [res] ``` Request-level JavaScript hooks are also evaluated: ```python # tools/acquire/url_option.py:164-180 def apply_js(self, js_bridge): """Execute option js/bodyJs with the URL or body supplied as result.""" if not js_bridge: return self o = self._clone() if self.js: try: o.url = js_bridge.eval(self.js, variables={"result": self.url}) except Exception: ...[truncated 4191 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/acquire/fetcher.py:155
Finding: Unrestricted Acquisition Requests Permit SSRF While TLS Verification Is Disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements-extra.txt:12
Finding: Optional Runtime Dependencies Use Open-Ended Version Constraints Without Integrity Hashes
Content: View full analysis
=0.18 ``` ```text # requirements-extra.txt:12-13 PyExecJS>=1.5 curl_cffi>=0.10 ``` The setup process also upgrades pip and installs directly from the requirements file without hash enforcement: ```python # setup_env.py:59-66 # Upgrade pip run([py, "-m", "pip", "install", "--upgrade", "pip"], cwd=str(ROOT)) # Install core dependencies print(f"Installing core dependencies ({REQ.name})...") run([py, "-m", "pip", "install", "-r", str(REQ)], cwd=str(ROOT)) ``` ### Technical Analysis The core manifest pins most packages to exact versions, but `ebooklib` and the optional online-acquisition packages use `>=` constraints. These constraints allow future releases to be selected without a code change or review. None of the manifests provide package hashes. `PyExecJS` is particularly security-sensitive because it participates directly in executing source-supplied JavaScript. A compromised or unexpectedly changed release would execute in the same process context as the acquisition subsystem. `curl_cffi` is listed despite comments indicating that it has not yet been integrated, increasing supply-chain exposure without providing current runtime value. The unconditional pip upgrade also retrieves and executes a changing package version, undermining reproducibility. This finding does not establish that any listed package is currently malicious. The risk arises from allowing unreviewed future artifacts and transitive dependency versions to enter the environment. ### Attack Path 1. The user runs the setup command or installs the optional acquisition dependencies. 2. Pip resolves the latest versions satisfying the ...[truncated 996 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (146)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A low-level network request construction and rule-execution component is far broader than necessary for course generation and tutoring, and it increases the chance of SSRF-like misuse, unauthorized outbound access, or abusive scraping. Because the skill is framed as educational, these hidden network primitives create a trust mismatch that makes the context more dangerous, not less.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tools/acquire/js_bridge.py:262

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tools/acquire/js_runtime.js:177

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: tools/acquire/fetcher.py:162