Security audit

WeRead Book Finder

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and disclosed, but it will reuse logged-in browser sessions and may save downloaded books from Z-Library to your Downloads folder.

Install only if you are comfortable logging into WeRead and Z-Library through a persistent skill-specific browser profile, letting the skill add books to your WeRead shelf, and saving downloaded ebook files locally. Use it only for content you are authorized to access, and avoid running it on shared machines unless you clear the browser profile afterward.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill’s stated purpose understates several sensitive behaviors: manual login flows, persistent browser profile reuse, and downloading files from Z-Library to local disk. This mismatch is dangerous because users may invoke a seemingly simple book-search skill without realizing it can access authenticated sessions and write files locally, increasing the chance of unintended account use, privacy leakage, and policy or legal violations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool scope or permissions even though its documented behavior requires network access and browser automation. This weakens security boundaries because an agent or reviewer cannot reliably tell in advance that the skill will contact external services, authenticate to websites, and perform remote actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description does not clearly warn that it may automatically download books from Z-Library and save them to the local filesystem. Automatic downloads are a sensitive action because they create local artifacts, may expose the system to untrusted files, and may surprise users who only intended a search or shelf-add operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The login-state section encourages reuse of persistent browser profiles for WeRead and Z-Library but does not provide a clear privacy warning about stored authenticated sessions. Reusing saved sessions can expose account data or allow unintended actions under a user’s identity if the environment is shared, compromised, or the skill is invoked unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code automatically downloads a file from Z-Library and writes it to the user's filesystem without any explicit confirmation, safety prompt, or trust verification of the selected result. In this skill's context, the fallback targets a piracy-oriented third-party site and uses browser automation to fetch content, which increases the risk of saving unwanted, mislabeled, or malicious files to disk without meaningful user awareness at the moment of download.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Playwright persistent browser context is created with locale set to "zh-CN", which imposes a specific language/locale policy on users. There is no visible opt-in, fallback, or justification in this file indicating that the skill is intentionally limited to a Chinese locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: On retry after singleton-lock cleanup, the code again hard-codes the browser locale to "zh-CN". This repeats the same locale restriction without providing user choice or an explanation that the tool is region-specific.
Content: No source excerpt is available for this finding.