Security audit

Book Organizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a book-note organizer, but it directs agents to download full ebooks from questionable external libraries and search for PDFs/downloads before summarizing them.

Review before installing. This skill may be useful for organizing books you already have rights to use, but its current instructions encourage agents to retrieve full books from external sites and save generated notes locally. Install only if you are comfortable constraining it to user-provided, licensed, or public-domain material and confirming any file writes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to search, download, and read full books from external ebook libraries, including well-known piracy/mirror sites. This exceeds the declared purpose of organizing book notes and introduces unauthorized data acquisition behavior, creating legal, policy, and security risk from fetching untrusted files and content.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documentation grants capability to retrieve books from unauthorized libraries that are not necessary for a book-organizing skill. Because the agent is being told to obtain copyrighted works from unjustified sources, the skill can be abused to automate infringement and ingestion of untrusted external files.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill states that it will save Markdown output to the local workspace, but it does not clearly require user confirmation before creating or modifying files. In agent environments, silent file writes can surprise users, overwrite existing notes, or be chained with other actions to persist unwanted content locally.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The manifest description is entirely in Chinese and frames triggering and operation around Chinese-language requests and Chinese-oriented resources, but it does not state that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are broad enough to match common requests like summaries, reviews, or knowledge organization, which can cause the skill to activate in contexts the user did not intend. In this skill, that matters because activation can cascade into external searching, downloading, and file writing behaviors.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill claims it only summarizes and does not copy full books, but earlier steps direct downloading and reading complete book files. This contradiction is dangerous because it masks the real behavior, making reviewers and users less likely to recognize unauthorized acquisition and full-text processing.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s title and all template sections are written as Chinese-only output formats, indicating the skill expects responses in a specific language. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified, which is not present here.

Static analysis

No suspicious patterns detected.