Epub2md Cli

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:03 AM UTC
• Version: 1.0.0

Overview

This EPUB conversion skill is mostly purpose-aligned, but it needs Review because it asks for an unpinned global npm install and has cleanup logic that can delete existing output directories without strong containment checks.

Install only if you are comfortable with a global, unpinned npm dependency and local workspace file writes. Prefer pinning epub2md to the reviewed version, installing it locally rather than globally, avoiding --localize for untrusted EPUBs unless you accept outbound network requests, and keeping --workspace-root pointed at a dedicated disposable directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–47
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

If it is missing and the environment allows installs, install it with npm:

```bash
npm install -g epub2md

text

### Technical Analysis

The Skill instructs users or agents to install `epub2md` globally from npm without pinning a reviewed version or verifying package integrity. Although the documentation states that behavior was validated against `epub2md 1.6.2`, the installation command retrieves whichever release the npm registry currently resolves as the latest version.

npm packages may execute lifecycle scripts during installation. Consequently, a compromised package, malicious newly published release, or compromised package-maintainer account could cause attacker-controlled code to execute with the privileges of the user running npm. The global `-g` installation also increases the installation scope and makes the resulting executable available to subsequent sessions and projects.

### Attack Path

1. An attacker compromises the `epub2md` package, its maintainer account, or its release process.
2. The attacker publishes a malicious release under the legitimate package name.
3. A user or agent follows the Skill prerequisite and runs `npm install -g epub2md`.
4. npm resolves and downloads the mutable latest release rather than the documented and reviewed `1.6.2` release.
5. Malicious lifecycle scripts may execute during installation, or malicious behavior may execute when the globally installed CLI is subsequently invoked.
6. The compromised global executable can affect EPUB conversion operations performed by this Skill and other users of that command.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account performing the installation or invoking the compromised CLI. The attacker could access or modify f
...[truncated 318 chars]

Remediation

View remediation

Remediation Suggestions

Pin installation to the explicitly reviewed version and avoid a global installation where possible:

bash

npm install --save-exact epub2md@1.6.2

Use a project-local dependency with a committed lockfile and invoke the local executable through npx --no-install epub2md or its explicit node_modules/.bin path. Enforce lockfile integrity in deployment or installation workflows and review dependency changes before upgrades.

Where compatible with the package, disable installation lifecycle scripts:

bash

npm install --save-exact --ignore-scripts epub2md@1.6.2

If lifecycle scripts are required, inspect them before allowing execution. In addition, run conversion under a minimally privileged account, restrict filesystem access to the required input and workspace directories, and document a controlled upgrade process that re-audits new versions before changing the pin.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill directs the agent to run shell commands and write files, but it declares no tool scope or permission boundaries. In environments that rely on skill metadata for policy enforcement, this can cause the skill to be invoked with broader capabilities than reviewers or orchestrators expect, increasing the chance of unintended command execution or file writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill whenever the user mentions .epub files or many related tasks, even if they do not explicitly request epub2md. That broad trigger can cause the skill to activate on loosely related requests and steer the agent into shell/file-writing flows unnecessarily, raising the risk of accidental data handling or side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes downloading remote images via --localize but does not give an explicit privacy or network warning. This can trigger outbound requests to third-party hosts embedded in EPUB content, leaking IP/addressing metadata or contacting attacker-controlled URLs without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to ask the clarification using specific Chinese phrases, which imposes a language choice regardless of the user's preferred language. This is a natural-language policy issue because the file does not provide opt-in or indicate that Chinese is only for Chinese-language interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

ensure_clean_directory unconditionally deletes any existing path via shutil.rmtree before recreating it. Because the destination paths are derived from user-influenced inputs such as the EPUB stem and configurable workspace_root, a mistake, crafted path collision, or symlink/path-manipulation scenario could lead to unintended data loss within reachable directories.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_epub2md.py (reported line 108)May include surrounding context.

python

def run_command(command: list[str], cwd: Path) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        command,
        cwd=str(cwd),
        check=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The --localize option enables downloading remote images referenced by the EPUB, which can cause outbound network requests to attacker-controlled hosts. In this skill context, users may inspect untrusted EPUBs, so enabling localization without a prominent warning increases risks of data transmission, IP disclosure, tracking, and interaction with malicious remote content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill instructs the agent to copy source EPUBs into a workspace and write outputs, including fallback flows that copy and stage files, but the description does not present a concise up-front warning that conversion creates files under a workspace and duplicates the source EPUB. While the behavior is documented in detail, it is framed operationally rather than as a user warning about data writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example good response is written only in Chinese, which can reinforce a requirement to answer in Chinese even when the user is using another language. Because the file does not state that examples should be localized to the user's language, this creates a locale-policy ambiguity.

Content

No source excerpt is available for this finding.