ClawHub
Back to skill

Security audit

对话读书助理

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local reading-notes skill, but it deserves Review because it can read, write, overwrite, delete, import, export, and display personal notes with broad path and trigger scoping.

Install only if you are comfortable with a local assistant maintaining a ./reading-notes knowledge base and showing it during searches or views. Use explicit reading-assistant commands, confirm deletes/imports carefully, keep imports to trusted note-export files, and avoid custom export paths unless you are sure overwriting that destination is safe.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill performs file reads and writes in the user's working directory but declares no permissions or equivalent capability disclosure. That creates a transparency and consent gap: users and host systems cannot easily distinguish simple note-taking from persistent filesystem modification, including deletion and export operations. In this context the behavior is expected for a reading-notes tool, but the undeclared capability still increases risk because it handles user data and can remove files.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The search triggers like '搜索XXX' or '查找关于XXX的笔记' are broad enough to overlap with normal conversation, which can cause the skill to activate unexpectedly. That may expose note contents, run searches across all books, or leak sensitive reading data when the user did not intend to invoke the skill. Because the skill accesses a personal knowledge base, accidental activation is more dangerous than in a non-sensitive utility.

Vague Triggers

Medium
Confidence
88% confidence
Finding
Very generic view triggers such as '查看笔记' or '显示笔记' can easily collide with ordinary requests and cause the agent to display stored excerpts without sufficient user intent verification. That can reveal private notes, book titles, or reading history in the wrong context, especially in shared screens or mixed conversations. The skill context makes this more sensitive because stored notes may contain personal reflections and imported third-party content.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The import trigger '导入笔记' or '批量导入' is ambiguous, yet it leads to requesting a file path and processing local files. Broad activation combined with file-path intake can cause unintended access to user files or trick the agent into parsing attacker-specified paths if conversation context is manipulated. In a skill with filesystem access, ambiguous import entry points materially raise risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.