kindle2md

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This Kindle-to-Markdown skill appears purpose-aligned, but it uses an unsafe shell command pattern and overwrites existing notes by default, so users should review it before installing.

Install only if you are comfortable with a local script reading Kindle HTML exports and writing into your Obsidian folder. Review the configured output path, avoid converting HTML files from untrusted sources, and consider changing the workflow so existing files are not overwritten without confirmation and the script is invoked with structured arguments rather than a constructed shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:40

Finding

Shell Command Injection Through Interpolated File Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

python "<skill_path>/scripts/kindle_notes_to_md.py" --override -o "<output_dir>/<书名>.md" "<用户提供的HTML路径>"

Technical Analysis

The documented runtime command interpolates multiple variable values into a shell command:

• The HTML path is supplied by the user.
• The book title is derived from the user-controlled filename.
• The output directory comes from an editable configuration file.

Double quotes do not safely escape an argument when the interpolated value can itself contain a double quote. A malicious filename or path can close the surrounding quoted argument and append shell syntax. If the agent follows this instruction by passing the constructed string to a shell, the injected syntax will be interpreted as commands rather than as part of a filename.

For example, a title derived from a filename resembling the following can break out of the output argument on a POSIX shell:

text

notes"; touch /tmp/skill-command-injection; #.html

Merely removing known filename metadata does not neutralize shell metacharacters. Quoting must be performed according to the target shell, or preferably avoided entirely through structured process execution.

Attack Path

1. An attacker creates or provides a Kindle HTML export whose filename contains a double quote followed by shell syntax.
2. The user asks the agent to convert that file.
3. The agent derives the book title from the malicious filename as required by the Skill.
4. The agent substitutes the title and input path into the command documented in SKILL.md.
5. If the resulting command is executed through a shell, the malicious quote terminates the intended argument.
6. The shell interprets the remaining text as one or more commands and executes them with the privileges ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by textual interpolation.

• Invoke the converter through a process API that accepts an argument array and disables shell parsing. For example, use the equivalent of:

  python

  subprocess.run(
      [
          sys.executable,
          script_path,
          "--override",
          "-o",
          output_path,
          input_path,
      ],
      shell=False,
      check=True,
  )
  

• Derive and validate the output filename inside trusted Python code rather than in agent-generated shell text.

• Reject path separators, control characters, null bytes, and platform-reserved filename characters from the derived title.

• Resolve the intended output path and verify that it remains inside the configured output directory.

• If a shell is unavoidable, apply correct platform-specific escaping to every dynamic argument. Simple double-quote wrapping is insufficient.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kindle_notes_to_md.py:148

Finding

Unescaped HTML-Derived Content Injected Into YAML Frontmatter and Markdown

Content

View full analysis

Vulnerability Details

File Location: scripts/kindle_notes_to_md.py, lines 148-179
Vulnerability Type: YAML frontmatter and Markdown content injection
Risk Level: Medium

Vulnerable Code

python

md = "---\n"
md += "title: {}\n".format(self.book_title)
md += "author: {}\n".format(self.author)
md += "date: {}\n".format(datetime.now().strftime('%Y-%m-%d'))
md += "tags: Books\n"
md += "type: book-note\n"
md += "---\n\n"

md += "# Raw Highlights & Notes\n\n"

for chapter in self.chapter_notes:
  md += "## {}\n\n".format(chapter.title)

  for location in chapter.notes:
    note = chapter.notes[location]

    md += "- {}\n".format(note.text)

    if note.note != '':
      md += "  - **{}**\n".format(note.note)

    if args.location:
      md += "  - {}\n".format(note.source)

    md += "\n"

Technical Analysis

Values parsed from the input HTML are inserted directly into the generated document without YAML serialization, newline validation, or Markdown escaping. The affected values include the book title, author, chapter titles, highlight text, user notes, and source descriptions.

A crafted title or author containing newline characters can introduce additional YAML properties or terminate the frontmatter delimiter early. Chapter and note content can inject arbitrary Markdown and Obsidian-specific constructs, including links, images, embeds, headings, or misleading document structure.

The input is parsed with BeautifulSoup, but HTML parsing does not make the extracted text safe for a different output language. YAML and Markdown each require output-context-specific serialization or escaping.

Attack Path

1. An attacker constructs a Kindle-like HTML file containing malicious title, author, chapter, or note text.
2. The user converts the file with the Skill.
3. parse_file() extracts the attacker-controlled text from the HTML.
4. output_md() concatenates that text ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

• Generate frontmatter with a maintained safe YAML serializer rather than string concatenation.
• Enforce scalar string values for metadata and reject unexpected control characters.
• If manual YAML generation is retained, quote values correctly and escape embedded quotes, newlines, document delimiters, and other YAML syntax.
• Escape or neutralize Markdown control characters in untrusted chapter titles, highlights, notes, and source descriptions.
• Consider exposing an explicit raw-content option only when the input file is trusted.
• Add tests using titles and notes containing newlines, ---, YAML keys, Markdown links, image syntax, Obsidian embeds, and other structural delimiters.
• Clearly warn users that converted HTML files should be treated as untrusted until their generated Markdown has been reviewed.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill performs file reads and writes, including reading a config file and writing converted output, but does not declare any tool scope or permissions boundaries. This creates an avoidable trust gap: an agent may execute filesystem-capable actions without explicit least-privilege constraints, making misuse or unintended file access more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to overwrite an existing markdown file if it already exists, with no confirmation, backup, or conflict-handling. This can destroy user data or silently replace unrelated notes if title extraction is imperfect or filenames collide.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

When the --clipboard option is used, the script copies the generated Markdown notes directly to the system clipboard. Clipboard contents can be read or overwritten by other applications, but the code provides no prior warning in comments, help text, or prompts about this privacy impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.