Security audit

电子书下载器

Security checks for vulnerabilities and agentic risk

Overview

This ebook skill is disclosed as a search/downloader, but it also guides agents to retrieve files from community netdisk sources and unpack untrusted archives, including for copyrighted books.

Review carefully before installing. It may be useful for finding public-domain or licensed ebooks, but it also normalizes community netdisk retrieval and agent-assisted downloading of files that may be unauthorized or unsafe. Use only with clear user consent, avoid fetching copyrighted works from unofficial hosts, and do not unpack untrusted archives outside a constrained environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill claims to operate across '10 legal sources' but also instructs the agent to handle copyrighted Chinese titles through community netdisk lists and ctfile/netdisk retrieval. This is a deceptive scope mismatch: it lowers operator suspicion while embedding workflows that facilitate access to likely infringing copies, making the skill more dangerous in this ebook-search context than a plainly labeled general search tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This playbook goes beyond ebook discovery and instructs the agent to obtain direct download URLs from community netdisk sources, download archives, extract ebook files, and deliver them to the user. In an ebook-search skill, this meaningfully expands capability into acquisition of potentially unauthorized content and operationalizes retrieval from third-party file hosts, increasing legal, policy, and malware exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document provides concrete browser-console/API extraction steps, curl-based download instructions, and archive extraction code that enable the agent to interact with site internals and retrieve content not needed for search. This is dangerous because it turns a search skill into an automated downloader handling untrusted remote files, which can facilitate abuse and enlarge the attack surface beyond the declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are broad enough to activate on routine mentions of book titles, file formats, or generic reading requests, which can cause the skill to take over conversations without clear user intent. In this skill's context, over-triggering is more dangerous because the skill may then steer users toward questionable download sources or copyrighted-material workflows rather than neutral search assistance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation materially expands behavior from search-and-link guidance into agent-assisted netdisk retrieval workflows, including following host-specific playbooks for fetching files. In context, those workflows target community netdisk sources that can include copyrighted material and move the agent from passive discovery into active acquisition, increasing legal/compliance risk and enabling unsafe browser/API automation beyond the declared 'legal sources' scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The referenced ctfile playbook explicitly signals support for direct download extraction from a netdisk host, which contradicts the manifest's framing as a search tool over legal sources. That hidden extension of capability is dangerous because it provides operational instructions for obtaining files from unofficial storage services, likely including copyrighted works, and can bypass expected safeguards around declared functionality.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow is framed as part of the ebook scout process, but the actual steps perform retrieval, download, and file delivery. That mismatch is risky because it can cause operators or higher-level orchestrators to treat powerful file-acquisition behavior as routine search functionality, bypassing expected safeguards and user expectations.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The staged procedure extracts page variables and calls the host's backend endpoint to obtain a direct downurl, effectively bypassing the normal interactive download flow. This is dangerous because it systematizes circumvention of host controls and enables automated acquisition from third-party file hosts, which is particularly risky in a skill oriented around finding downloadable books that may be unauthorized copies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The playbook instructs downloading archives, writing files to disk, and extracting contents from untrusted ZIP files without explicit warnings about filesystem changes or archive risks. Even though it filters extensions during extraction, it still normalizes handling of untrusted content and could expose the environment to malicious files, oversized archives, or unsafe downstream processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description specifies use for books 'in Chinese or English' and the skill display name and instructions are partly Chinese, but it does not state that language handling is user-selectable or that the scope is intentionally restricted for a documented regional reason. This creates a mild language/locale policy concern because the skill appears to privilege specific languages by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.