电子书下载器

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:46 AM UTC
• Version: 1.0.0

Overview

This ebook skill is disclosed as a search/downloader, but it also guides agents to retrieve files from community netdisk sources and unpack untrusted archives, including for copyrighted books.

Review carefully before installing. It may be useful for finding public-domain or licensed ebooks, but it also normalizes community netdisk retrieval and agent-assisted downloading of files that may be unauthorized or unsafe. Use only with clear user consent, avoid fetching copyrighted works from unofficial hosts, and do not unpack untrusted archives outside a constrained environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill claims to operate across '10 legal sources' but also instructs the agent to handle copyrighted Chinese titles through community netdisk lists and ctfile/netdisk retrieval. This is a deceptive scope mismatch: it lowers operator suspicion while embedding workflows that facilitate access to likely infringing copies, making the skill more dangerous in this ebook-search context than a plainly labeled general search tool.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This playbook goes beyond ebook discovery and instructs the agent to obtain direct download URLs from community netdisk sources, download archives, extract ebook files, and deliver them to the user. In an ebook-search skill, this meaningfully expands capability into acquisition of potentially unauthorized content and operationalizes retrieval from third-party file hosts, increasing legal, policy, and malware exposure.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The document provides concrete browser-console/API extraction steps, curl-based download instructions, and archive extraction code that enable the agent to interact with site internals and retrieve content not needed for search. This is dangerous because it turns a search skill into an automated downloader handling untrusted remote files, which can facilitate abuse and enlarge the attack surface beyond the declared purpose.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger conditions are broad enough to activate on routine mentions of book titles, file formats, or generic reading requests, which can cause the skill to take over conversations without clear user intent. In this skill's context, over-triggering is more dangerous because the skill may then steer users toward questionable download sources or copyrighted-material workflows rather than neutral search assistance.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill documentation materially expands behavior from search-and-link guidance into agent-assisted netdisk retrieval workflows, including following host-specific playbooks for fetching files. In context, those workflows target community netdisk sources that can include copyrighted material and move the agent from passive discovery into active acquisition, increasing legal/compliance risk and enabling unsafe browser/API automation beyond the declared 'legal sources' scope.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The referenced ctfile playbook explicitly signals support for direct download extraction from a netdisk host, which contradicts the manifest's framing as a search tool over legal sources. That hidden extension of capability is dangerous because it provides operational instructions for obtaining files from unofficial storage services, likely including copyrighted works, and can bypass expected safeguards around declared functionality.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The workflow is framed as part of the ebook scout process, but the actual steps perform retrieval, download, and file delivery. That mismatch is risky because it can cause operators or higher-level orchestrators to treat powerful file-acquisition behavior as routine search functionality, bypassing expected safeguards and user expectations.

Ssd 4

Medium

• Confidence: 94% confidence
• Finding: The staged procedure extracts page variables and calls the host's backend endpoint to obtain a direct `downurl`, effectively bypassing the normal interactive download flow. This is dangerous because it systematizes circumvention of host controls and enables automated acquisition from third-party file hosts, which is particularly risky in a skill oriented around finding downloadable books that may be unauthorized copies.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The playbook instructs downloading archives, writing files to disk, and extracting contents from untrusted ZIP files without explicit warnings about filesystem changes or archive risks. Even though it filters extensions during extraction, it still normalizes handling of untrusted content and could expose the environment to malicious files, oversized archives, or unsafe downstream processing.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The description specifies use for books 'in Chinese or English' and the skill display name and instructions are partly Chinese, but it does not state that language handling is user-selectable or that the scope is intentionally restricted for a documented regional reason. This creates a mild language/locale policy concern because the skill appears to privilege specific languages by default.

Static analysis

No suspicious patterns detected.