Audible Deal Scout

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:05 AM UTC
• Version: 0.1.18

Overview

The skill performs the advertised Audible/Goodreads deal workflow, with sensitive features like auth tokens, delivery, and scheduling disclosed as optional and user-directed.

Install only if you are comfortable giving the skill access to the Goodreads CSV, notes, delivery target, and optional Audible auth file you configure. Keep the auth file private, use privacyMode minimal if you do not want personal reading data used in the model step, and enable cron triggers only on a trusted OpenClaw host you control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 137)May include surrounding context.

md

## 0.1.1

- Move the published wrapper entrypoint from `bin/` to `scripts/` so the package layout matches ClawHub skill conventions
- Update SKILL and README command examples to use the published `scripts/audible-goodreads-deal-scout` wrapper path
- Add release guidance to verify the published file manifest after upload

## 0.1.0

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description centers on cross-referencing Audible promotions with Goodreads data and optional user inputs/workflows. In contrast, the supplied code is specifically an auth/pricing module for Audible: it builds an external Amazon login URL, exchanges an authorization code for bearer/refresh tokens, persists an auth file with security checks, refreshes access tokens, calls Audible catalog APIs, and extracts pricing/discount fields. While authenticated price lookup could be a supporting part of a larger deal-scout skill, the code chunk itself implements substantial undeclared capability (credentialed auth and token management) and does not implement the Goodreads, notes, delivery, or audit behavior claimed by the description. That makes the description inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description focuses on content evaluation of Audible deals versus Goodreads data, with mentions of scheduled sends and setup. However, this specific code chunk is not performing the evaluation/audit logic itself; instead it provides automation and delivery infrastructure: persisting configuration, creating trigger scripts, managing cron jobs, and sending messages through openclaw. Those are material capabilities not reflected in the declared permissions/triggers and only partially implied by vague references to setup and scheduled sends. Because the actual chunk’s primary behavior is orchestration/automation and external delivery rather than Goodreads/Audible deal analysis, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code does not implement Audible/Goodreads deal evaluation or any reading/backlog analysis. Its primary purpose is a repository audit utility for detecting sensitive information in files. That is a materially different capability from the declared description. It also accesses repository contents and an environment variable, which are not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audible_goodreads_deal_scout/audible_auth.py (reported line 442)May include surrounding context.

python

seconds_remaining = int(expires - time.time())
            expired = seconds_remaining <= 0
            if expired:
                warnings.append("Audible access token is expired; refresh will be attempted on the next authenticated request.")
        except Exception:
            warnings.append("Auth file contains an unreadable expires value.")
    ready = status == "ready" and bool(payload.get("refreshToken"))

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 7)May include surrounding context.

md

## 0.1.18 - 2026-07-19

- Add a deterministic scheduled gate so positive-only suppressions do not start an agent or create cron run history
- Use OpenClaw condition triggers, lightweight bootstrap context, and disabled model thinking for substantially smaller scheduled runs
- Reconcile and diagnose cron trigger, context, schedule, IANA timezone, and delivery-route drift; support explicit automation and route removal
- Preserve unknown and marketplace-specific config values, resolve configured relative paths from the config directory, and fail closed on malformed config or state

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares broad operational capabilities in practice—shell execution, file reads/writes, network access, environment access, scheduling, and message delivery—but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an avoidable trust gap: a host or reviewer cannot easily constrain what the skill may do, and the skill handles sensitive local artifacts like config and Audible auth tokens, making overbroad execution more dangerous.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audible_goodreads_deal_scout/audible_fetch.py (reported line 347)May include surrounding context.

python

def _run_curl(command: list[str], url: str) -> subprocess.CompletedProcess[str]:
    try:
        return subprocess.run(command, capture_output=True, text=True, timeout=35)
    except subprocess.TimeoutExpired as exc:
        raise AudibleFetchError(
            f"Audible curl fallback timed out for {url}.",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This module relies on subprocess execution of the OpenClaw binary and shell wrapper scripts, including generated trigger scripts that call an exec tool. For a skill framed primarily as evaluating promotions against Goodreads and sending results, arbitrary local command execution is a stronger host capability than the manifest suggests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audible_goodreads_deal_scout/delivery.py (reported line 31)May include surrounding context.

python

def _run_openclaw(command: list[str], *, timeout: int, action: str) -> subprocess.CompletedProcess[str]:
    try:
        return subprocess.run(command, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired as exc:
        raise RuntimeError(f"{action} timed out after {timeout} seconds.") from exc

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes evaluating Audible deals against Goodreads data and optional delivery, but this file also provisions persistent scheduled automation by constructing cron add/edit commands and trigger scripts. Creating and managing scheduler state is a separate orchestration capability that is not clearly justified by a deal-scoring skill's core purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code persistently writes runtime-input.json, runtime-prompt.md, runtime-output-schema.json, and prepare-result.json, and those structures include personal-data summaries and artifact paths derived from prep_result. There is no confirmation prompt, print/log disclosure, or inline warning in this file to signal that user-related data will be stored on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code normalizes the marketplace then raises an error unless it is exactly "us", which is a natural-language locale constraint embedded in behavior. Under the policy, forcing a specific locale without user opt-in or clear documented justification is a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTTP request hard-codes the Accept-Language header to "en-US,en;q=0.9", which imposes a specific language/locale on all fetches. This is a natural-language policy concern because the file does not offer user opt-in or explain why English must be forced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The request headers hard-code Accept-Language: en-US,en;q=0.9, which imposes a specific language/locale preference on all fetches. This is a natural-language policy concern because the file does not offer user opt-in or explain why English is required for this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The request hard-codes an Accept-Language header of en-US,en;q=0.9, which forces an English locale for all users. This is a natural-language/locale policy concern because the code does not offer any user choice or document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code writes JSON and Markdown reports to paths from configuration using atomic file writes, but there is no prompt, print/log disclosure, or nearby comment/docstring warning that files will be created or overwritten. Because these are filesystem-modifying operations, the skill should provide some user-visible notice unless that behavior is explicitly disclosed elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.