Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local book-review helper with no evidence of hidden data access, network use, persistence, or destructive behavior.
Installers should treat this as a benign local writing helper. For stronger supply-chain hygiene, prefer a release that pins dependency versions and includes a lockfile, and be aware that broad book-review trigger phrases may invoke the skill for general reading-note requests.
This markdown file includes example user utterances like "帮我整理成书评", "之前读的那本书讲了什么来着", and "把这段话展开" as activation-style descriptions. These are common conversational phrases and the file does not clearly limit them to explicit slash commands or provide exclusion conditions, which could cause unintended invocation overlap.
The only invocation example is written in Chinese and the README does not state that other languages are supported or that Chinese is optional. This can be read as a language-specific usage expectation without explicit user opt-in, which may conflict with a language/locale choice policy.
The document presents core onboarding and sample usage in Chinese, including the first-success path and multiple example inputs, without stating that the user may choose their preferred language. This can amount to a language/locale policy issue because the skill implicitly steers interaction into a specific language rather than explicitly offering opt-in or multilingual support.
The runtime dependency openclaw is specified with a caret range, which permits installation of newer releases than the one the author tested. That weakens supply-chain reproducibility and can silently introduce a vulnerable or malicious version, especially notable here because the dependency already has multiple published advisories and this skill executes under the OpenClaw runtime.
},
"homepage": "https://github.com/harrylabs0913/openclaw-skill-book-review#readme",
"dependencies": {
"openclaw": "^2026.3.0"
},
"devDependencies": {
"@types/node": "^20.10.0",
The manifest references openclaw with a floating version even though the package has numerous known advisories, making it impossible to determine from this file whether the installed version is affected. Because openclaw is the core runtime dependency for the skill, any unresolved vulnerability there could directly affect execution, isolation, or handling of user data.
@types/node is unpinned, which reduces build reproducibility, but it is a development-only type package and does not ship as runtime code. The security impact is therefore limited, though it can still destabilize builds or pull in unexpected transitive content during development.
"openclaw": "^2026.3.0"
},
"devDependencies": {
"@types/node": "^20.10.0",
"esbuild": "^0.19.8",
"typescript": "^5.3.2"
},
esbuild is a development dependency specified with a caret range, allowing unreviewed updates in the build toolchain. While this skill claims local-only processing, a compromised or vulnerable build dependency can still affect maintainers or CI systems during build and packaging.
},
"devDependencies": {
"@types/node": "^20.10.0",
"esbuild": "^0.19.8",
"typescript": "^5.3.2"
},
"engines": {
esbuild has known advisories and the version is not pinned, so the actual exposure cannot be verified from the manifest alone. In this package it is a dev dependency, which lowers end-user risk, but it still matters for developers and CI because vulnerable build tooling can expose local files or permit unintended network interactions in development contexts.
typescript is unpinned, which creates non-reproducible builds and opens a minor supply-chain risk through the developer toolchain. Because it is not a runtime dependency, the direct impact on users of the skill is lower than for production packages.
"devDependencies": {
"@types/node": "^20.10.0",
"esbuild": "^0.19.8",
"typescript": "^5.3.2"
},
"engines": {
"node": ">=18.0.0"
No suspicious patterns detected.