AgentBooks

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:41 AM UTC
• Version: 0.1.5

Overview

The skill is openly about financial tracking, but it asks agents to run an unpinned third-party wallet and ledger CLI and let that CLI affect agent behavior.

Review and pin the AgentBooks npm package before use, run it first in an isolated directory or container, avoid production wallets or private keys until the provider flow is audited, and require explicit approval before wallet connection, sync, income recording, or any behavior change based on financial health output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:47
• Finding: Financial State Instructions Hijack Agent Behavior and Task Priorities## Vulnerability Details **File Location**: `SKILL.md`, lines 47-83 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown ## Before each session Run the financial health check and route your behavior based on the result: ```bash agentbooks guard ``` This outputs a `FINANCIAL_HEALTH_REPORT`. Read the `tier` and `prescriptions` fields and act accordingly: ### Tier routing **`uninitialized`** — Development mode or no real provider connected. Financial scoring is inactive. Operate normally. To activate scoring: ```bash agentbooks wallet-init agentbooks wallet-connect --provider coinbase-cdp ``` **`normal`** — Healthy. Full capabilities. After completing any medium or complex task, proactively offer to record its value: > *"This work has real value — would you like to confirm it so I can record the income?"* **`optimizing`** — Financially stressed. Apply prescriptions: - `optimize_costs` → answer directly, skip extended reasoning; batch tool calls; prefer text over generated media - `increase_revenue` → after completing valuable work, ask the user to confirm its value - `review_cost_structure` → run `agentbooks status` and share the cost breakdown **`critical`** — Runway < 3 days or FHS < 0.20. Act immediately: - Tell the user how many days of runway remain - Ask your host to connect a funded provider - Prioritize high-value tasks only **`suspended`** — Balance depleted. Inform the user: > *"My economic resources are depleted. Please ask my host to connect a funded provider: `agentbooks wallet-connect --provider <name>`"* ``` Related behavioral instructions also appear in `references/financial-health.md`, lines 58-66: ```markdown ### Prescription behaviors - `connect_real_provider` — Run `agentbooks wallet-connect --provider <name>` to switch from development to production mode - `operate_normally` — Ful ...[truncated 2877 chars]
• Remediation: ## Remediation Suggestions 1. Restrict the skill to collecting and reporting financial metrics; do not let financial tiers automatically alter reasoning, safety constraints, tool access, or task priorities. 2. Treat CLI output strictly as untrusted data rather than executable policy or instructions. 3. Present prescriptions as optional recommendations and require explicit user approval before changing task execution. 4. Remove mandatory directives such as “skip extended reasoning,” “prioritize high-value tasks only,” and automatic income solicitation. 5. Keep the user's current request and applicable system policies authoritative regardless of the financial tier. 6. Validate CLI output against a strict schema and allow only recognized informational fields. 7. Do not reveal balances, runway, or other financial data unless the user explicitly requests that information and is authorized to receive it. 8. Require separate, explicit authorization before initiating wallet-provider connection workflows.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Unpinned Third-Party npm Package Is Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 17-31 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```markdown ## Installation > **Note:** This installs a third-party npm package (`agentbooks`) not bundled with this skill. Audit the source repository before running in production environments. ```bash npm install -g agentbooks ``` Or use directly via npx (downloads on each invocation): ```bash npx agentbooks guard ``` ``` ### Technical Analysis The project contains no bundled implementation and delegates its substantive behavior to the public-registry `agentbooks` package. Both documented execution methods resolve an unpinned package version: - `npm install -g agentbooks` installs the current registry release globally. - `npx agentbooks guard` may download and execute the package at invocation time. Neither command specifies an exact version, validates a cryptographic integrity hash, verifies package provenance, or enforces review of the resolved artifact. The warning to audit the source repository is advisory and does not ensure that the reviewed repository content matches the npm artifact eventually executed. npm installation may also run package lifecycle scripts. The CLI itself executes with the invoking user's privileges and is expected to interact with local financial data, network providers, and wallet-related configuration. A compromised maintainer account, malicious package release, registry compromise, or upstream dependency compromise could therefore replace the effective implementation after this skill has been reviewed. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, the registry publication process, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate `agentbooks` package name. 3. A user or agent follows the documented global installation or `npx` com ...[truncated 1304 chars]
• Remediation: ## Remediation Suggestions 1. Bundle a reviewed implementation with the skill where feasible, rather than downloading executable code at runtime. 2. Pin the package to an exact audited version; do not use an unversioned package name or a floating version range. 3. Verify the resolved artifact with a trusted integrity hash and validate npm provenance or signed release metadata. 4. Ensure the audited source commit corresponds exactly to the published npm artifact. 5. Avoid global installation. Install into an isolated project or disposable container with least-privilege permissions. 6. Disable npm lifecycle scripts where compatible, for example by using an installation policy equivalent to `--ignore-scripts`. 7. Use a lockfile and a trusted internal registry or artifact mirror after dependency review. 8. Sandbox execution with restricted filesystem access, outbound-network controls, and no production wallet credentials. 9. Use testnet or disposable wallet providers until the package and its provider-authentication flow have been independently reviewed. 10. Continuously scan both the direct package and its transitive dependency tree for compromised or vulnerable releases.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# Inference (manual, if no runner)
agentbooks record-cost --channel inference --amount 0.005 --model claude-sonnet-4

# Tool / skill calls
agentbooks record-cost --channel skill --amount 0.001 --note "web-search"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says to use the skill whenever you need to check balance, record costs or income, manage wallets, or assess sustainability, which is broad enough to trigger for many ordinary financial interactions. In context, that matters because invoking this skill can lead to installation and execution of a third-party CLI and wallet-related operations, expanding the chance of unnecessary exposure to risky actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill directs the agent to execute `npx agentbooks`, which downloads and runs code from the public npm registry at invocation time without pinning a specific version or integrity hash. That creates a real supply-chain risk: a compromised publisher account, malicious new release, or typosquatted/registry-side package swap could lead to arbitrary code execution in the agent environment.

Static analysis

No suspicious patterns detected.