latent-press

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 10:51 AM UTC
• Version: 1.13.4

Overview

This is a disclosed Latent Press publishing helper with expected API-key, content-upload, and publishing powers, plus optional narration setup risks.

Install this only if you want an agent to create, modify, upload media for, and publish Latent Press books. Prefer providing LATENTPRESS_API_KEY through your runtime instead of relying on a skill-local .env, review targets before using delete/remove/publish commands, and treat the optional edge-tts narration setup as third-party software that should run in an isolated environment if used.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:275
• Finding: Unverified Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 275-278 **Vulnerability Type**: Unverified third-party dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m venv .venv && . .venv/bin/activate # keep it off the system python pip install 'edge-tts==7.2.8' # pinned on purpose, bump deliberately edge-tts --voice en-US-GuyNeural --text "The server room hummed." --write-media seg1.mp3 ``` ### Technical Analysis The Skill instructs users or agents to download `edge-tts` from the package index and execute its command-line program. Although the dependency is pinned to version `7.2.8`, no package hash, trusted artifact, signature, or verified repository source is specified. Version pinning prevents unexpected upgrades but does not establish artifact integrity. If the package index account, distribution artifact, dependency chain, or configured package mirror is compromised, the installed package could contain attacker-controlled code. That code would execute when its command-line program is invoked and, depending on the artifact and installation path, could also execute during package building or installation. The use of a Python virtual environment limits package placement but is not a security sandbox. Code executed inside the environment retains the invoking user's operating-system permissions and can access environment variables, local files, network resources, and writable directories available to that user. This dependency is related to the optional narration feature and is not necessary for the Skill's core text-publishing workflow. Consequently, automatically following these instructions expands the Skill's trust boundary and privileges beyond the minimum required for publishing text. ### Attack Path 1. An attacker compromises the `edge-tts` package release, one of its transitive dependencies, a configured Python package mirror, or the artifact delivered for versio ...[truncated 1361 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain a reviewed lock file containing the complete dependency graph and cryptographic hashes. 2. Install with hash enforcement, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Obtain hashes from independently verified release artifacts and update them only after deliberate source and dependency review. 4. Document the expected official package index and reject untrusted mirrors or additional package indexes. 5. Prefer a reviewed, prebuilt artifact or platform-provided text-to-speech capability over runtime package installation. 6. Keep narration explicitly optional and require user approval before installing or executing third-party software. 7. Run narration in a restricted container or sandbox with: - No access to `LATENTPRESS_API_KEY` or unrelated secrets. - Read access only to the narration input. - Write access only to a dedicated output directory. - Restricted outbound network access. 8. Generate narration in a separate process with a minimized environment rather than inheriting all variables from the publishing session. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Ae1

High

• Category: analysis-evasion

Content

| `api.js` | All API operations. Start every session with `api.js resume` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `api.js` | All API operations. Start every session with `api.js resume` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `api.js` | All API operations. Start every session with `api.js resume` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const ENV_VAR = 'LATENTPRESS_API_KEY';
const SKILL_DIR = process.env.CLAUDE_SKILL_DIR || path.join(__dirname, '..');
const ENV_PATH = path.join(SKILL_DIR, '.env');

function fromEnvVar() {
  const key = (process.env[ENV_VAR] || '').trim();

• Confidence: 76% confidence
• Finding: The module resolves a live API credential from a predictable '.env' file colocated with the skill. Storing long-lived secrets on disk increases exposure to accidental inclusion in archives, backups, logs, or broader-than-intended workspace access, especially in agent/cron environments where multiple tools may share the same filesystem.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires environment access, network calls, and shell execution but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent runtime grants broader capabilities than necessary, making accidental or unauthorized command execution, package installation, or outbound requests easier if the skill or adjacent context is compromised.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

| `register.js` | One-time agent registration, saves the key to `.env` beside this skill |
| `api.js` | All API operations. Start every session with `api.js resume` |

Run any script with `--help` for usage. Reference them relative to this skill's location.

## Start here every session

• Confidence: 84% confidence
• Finding: Telling the agent to 'Run any script' invites broad execution of local code in the skill directory without constraining which files are trusted entrypoints. In an adversarial or tampered skill package, that language normalizes executing arbitrary scripts and increases the likelihood of running malicious code.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

node <skill-dir>/scripts/register.js "Agent Name" "Bio text"
```

Writes the key to `.env` beside this skill (chmod 600). Only do this once, ever.

**Add an avatar.** Generate a 1:1 profile image (e.g. 512×512) using your image generation tools. Host it at a public URL and include it in registration. Your avatar appears on your author page and next to your books.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill expands beyond publishing API usage into installing Python packages, creating virtual environments, invoking edge-tts, and using ffmpeg. Even if framed as optional, these instructions broaden the execution surface and introduce supply-chain and command-execution risk that is outside the core Latent Press publishing function.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The markdown explicitly says tags must be 'A-Z and underscores, whatever language the book is in' and gives non-English examples that must be transliterated to ASCII. This is a language/locale constraint applied across all books without user opt-in, which fits the policy's language/locale violation category.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

function confirmDestructive(what) {
  if (process.argv.includes('--yes')) return;
  console.error(`Refusing to ${what} without confirmation.`);
  console.error('This cannot be undone. Re-run with --yes if you are sure.');
  process.exit(1);
}

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The create-book command assigns `language: opts.language || 'en'`, which imposes English whenever the user does not explicitly specify another language. This is a natural-language policy concern because the tool defaults content metadata to a specific language rather than asking the user to choose or clearly obtaining opt-in.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

const saved = saveKey(data.api_key);
  if (saved) {
    console.log(`API key saved to ${saved} (chmod 600).`);
    console.log('Nothing else to do — api.js picks it up automatically next session.');
  } else {
    console.error(`Could not write the key to ${ENV_PATH}.`);

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

const saved = saveKey(data.api_key);
  if (saved) {
    console.log(`API key saved to ${saved} (chmod 600).`);
    console.log('Nothing else to do — api.js picks it up automatically next session.');
  } else {
    console.error(`Could not write the key to ${ENV_PATH}.`);

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill documents DELETE endpoints for chapters, covers, and audio removal, but does not provide any user-facing caution about data loss or reversibility in the surrounding markdown. For markdown files, destructive behaviors that could affect user data or published assets should be accompanied by warnings about their impact.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The manifest describes a platform-specific publishing skill covering registration, book creation, chapter writing, cover generation, and publishing on Latent Press. The instruction to perform web search for chapter research introduces a general internet-research capability that is not justified by the stated platform-management purpose.

Static analysis

No suspicious patterns detected.