Audible Deal Scout

• Outcome: Pass
• Latest audit: Jul 20, 2026 · 5:21 AM UTC
• Version: 0.1.18

Overview

This skill is a disclosed Audible/Goodreads deal checker with optional local personalization, delivery, scheduling, and Audible authentication, but no evidence of hidden exfiltration, purchases, or destructive behavior.

Install only if you are comfortable letting it read the Goodreads CSV and notes paths you configure and write recommendation artifacts in the workspace. Use privacyMode minimal if you do not want personal notes/reviews used in the model-facing step, avoid Audible auth unless you need member-visible prices, keep the auth file private, and enable cron or delivery only on a trusted OpenClaw host and channel.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill directs the agent to perform shell execution, file reads/writes, network access, and possible environment-dependent operations, yet it declares no permissions. This creates a trust gap: a host or user may treat the skill as low-privilege while it actually orchestrates powerful local and network actions, including handling sensitive auth files and registering cron jobs. In this context, the mismatch is more dangerous because the skill explicitly manages persistent state, external fetches, delivery integrations, and optional authentication artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This code adds a full external Amazon/Audible authentication and device-registration workflow, including login URL generation, authorization-code handling, token issuance, refresh, and authenticated product lookup. That materially exceeds the skill's stated deal-scoring purpose and expands the attack surface by introducing sensitive credential handling and privileged account access that users may not reasonably expect from the description.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The metadata explicitly states that the skill stores a refresh token, but the visible skill description does not mention persistent credential storage. Hidden long-lived credential persistence is dangerous because it enables ongoing account access beyond a single run and increases the risk of surprise misuse, token theft, or unauthorized continued API activity.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The constants and client construction indicate emulation of an Audible iOS client/device type to obtain authentication and API access. Impersonating a first-party mobile client is risky because it may bypass normal integration expectations, rely on unofficial/private interfaces, and collect account tokens under misleading technical pretenses not justified by a simple deal-scout skill.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt broadly instructs the system to 'use $audible-goodreads-deal-scout' for setup or evaluation without defining clear activation boundaries or required user intent. In agent ecosystems, this can cause over-broad invocation, unintended tool usage, or prompt-routing abuse where unrelated requests are steered into this skill and expose user data or trigger actions such as delivery/finalization unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code writes personal Goodreads-derived data, including matched entries, ratings/reviews-derived fit context, review source text, and freeform notes, into artifact files on disk. Although this appears necessary for the skill’s workflow, this file does not provide a clear consent/disclosure gate, minimization beyond privacy mode checks, or storage protection controls, so sensitive reading-history data may be exposed to other local users, backups, logs, or downstream tooling.

VirusTotal

56/56 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.