find-ebooks / 搜好书

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:39 AM UTC
• Version: 1.1.0

Overview

The skill does what it says: searches Anna's Archive and several book platforms, but users should understand it makes third-party requests, may return copyright-sensitive download links, and can use an optional WeRead API token.

Install in an isolated Python environment, pin/audit dependencies if possible, and only use this skill for lawful book discovery. Expect searches to contact Anna's Archive and several third-party book sites; avoid sensitive search terms, and do not set WEREAD_API_KEY unless you want account-linked WeRead requests made by this skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: ``` 2. Install dependencies with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin and audit all transitive dependencies through a generated lock file. 4. Review dependency updates before changing pinned versions. 5. Prefer installation inside a dedicated virtual environment or restricted container. 6. Add automated dependency vulnerability and package-integrity scanning to the release process. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/test_find_ebooks.py:17

Finding

Shell Command Injection Through Test Command Execution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This is a true tool-parameter abuse risk because the helper sends a composed command string into a shell. In an agent context, shell-based execution is more dangerous than in a standalone local test because command fragments can be influenced by surrounding automation, environment values, or later code changes, turning test execution into arbitrary command execution.

Content

Scanner excerpt · scripts/test_find_ebooks.py (reported line 20)May include surrounding context.

python

print(f'\n━━━ 测试: {name} ━━━')
    print(f'命令: {cmd}')
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
        output = r.stdout + r.stderr
        if r.returncode != 0:
            print(f'❌ 失败 (返回码 {r.returncode})')

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a Python script, requires environment variables, and performs outbound network access, yet it declares no explicit tool scope or permission boundaries. In an agent environment, this can allow broader-than-necessary shell, network, and environment access, increasing the chance of unintended external requests, proxy abuse, or execution in contexts where the user did not expect such capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly designed to search and provide download links for ebooks from Anna's Archive and other external platforms, but it does not warn users about copyright, legality, privacy, or the fact that network requests will be made to third-party services. In context, this omission is significant because the skill can facilitate access to pirated content and expose user queries to external sites or proxies without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to match common, ambiguous requests about books, authors, or searching, which can cause the skill to activate unexpectedly. Because the skill performs external lookups and can facilitate ebook downloading, mis-triggering may lead to unrequested network access or steer the agent into copyright-sensitive actions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user search terms and derived book metadata to Anna's Archive and several Chinese book platforms, plus optionally WeRead, without a strong user-facing disclosure of all recipients and data-sharing scope. This can leak user interests, reading habits, and potentially sensitive topics to multiple third parties, which is a meaningful privacy issue for a search skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script silently consumes a sensitive environment variable for authentication and may transmit authenticated requests without clearly informing the user. In a skill that appears to perform public book search, undisclosed credential use is risky because it changes trust assumptions and can cause unintended use of private entitlements or account-linked access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill reads a bearer token from the environment to access a third-party service, which expands capability beyond simple anonymous search and introduces credential-handling risk. In this skill context, fetching book availability does not require hidden credential access by default, so the behavior is more sensitive than the manifest suggests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_ebooks.py (reported line 265)May include surrounding context.

python

return None

        try:
            result = subprocess.run(
                [
                    'curl', '-s', '-X', 'POST',
                    'https://i.weread.qq.com/api/agent/gateway',

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Launching an external curl process gives the skill an unnecessary execution primitive unrelated to basic book-search logic, increasing attack surface and operational risk. While the current arguments are fixed, this design makes future misuse easier and exposes the environment and secrets to a subprocess boundary.

Content

No source excerpt is available for this finding.

Tainted flow: 'api_key' from os.environ.get (line 260, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/find_ebooks.py (reported line 265)May include surrounding context.

python

return None

        try:
            result = subprocess.run(
                [
                    'curl', '-s', '-X', 'POST',
                    'https://i.weread.qq.com/api/agent/gateway',

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The test helper executes a command string with shell=True, which enables shell metacharacter interpretation and command injection if any part of cmd becomes attacker-controlled. In this script, cmd is built using interpolated values and the pattern is inherently unsafe for an agent skill, especially if future tests or wrappers pass untrusted input into the helper.

Content

Scanner excerpt · scripts/test_find_ebooks.py (reported line 20)May include surrounding context.

python

print(f'\n━━━ 测试: {name} ━━━')
    print(f'命令: {cmd}')
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=60)
        output = r.stdout + r.stderr
        if r.returncode != 0:
            print(f'❌ 失败 (返回码 {r.returncode})')

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

技术细节中写明中文平台请求“带中文 Accept-Language”，表示该技能会固定使用中文语言偏好进行网络交互。文档未说明这是可配置项，也未提供用户选择或基于地区合规的正当化说明，因此构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Accept-Language header is fixed to prefer zh-CN and zh for requests to Chinese platforms. This imposes a locale preference in the skill's behavior without user opt-in or an exposed configuration option, which fits the language/locale policy concern for all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's docstring and user-visible messages are written in Chinese, and the script does not provide any option for users to choose another language. This can violate a language/locale policy when a skill forces a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code invokes another script with search queries against external ebook platforms, as indicated by the test descriptions and assertions for Anna's Archive, Douban, JD Books, Dangdang, and WeRead. While the script prints the command being run, it does not disclose that executing these tests will send queries over the network to third-party services.

Content

No source excerpt is available for this finding.