calibre-metadata-apply

• Outcome: Review
• Latest audit: Oct 10, 2026 · 12:49 PM UTC
• Version: 2.0.0

Overview

This skill is a disclosed Calibre metadata editor with review, dry-run, receipt, and credential-handling safeguards.

Install only for agents you trust to make Calibre metadata changes. Configure a single intended Calibre library or content-server endpoint, provide credentials through the documented environment variable, review the dry-run plan before apply, and keep receipts for reconciliation after failures.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

Read local connection facts from workspace AGENTS.md Tools. Endpoint precedence: --with-library, the CALIBRE_WITH_LIBRARY / CALIBRE_LIBRARY_URL / CALIBRE_CONTENT_SERVER_URL variables, then config.with_library. A server URL needs #LIBRARY_ID (or --library-id / CALIBRE_LIBRARY_ID / config.library_id). Local libraries must already contain metadata.db. There is no host autodiscovery/failover or server start.

Config: ~/.config/calibre-metadata-apply/config.json, or --config. Allowed keys: with_library, library_id, username, password_env, state_dir, reading_script (human-only legacy preference). No implicit .env loading. Unknown options fail rather than pretending to work. Legacy --save-auth/--save-plain-password/--server-hosts/auth-mode flags are removed.

Use the existing credential environment and --password-env (default CALIBRE_PASSWORD). The wrapper sends the secret through Calibre's documented <stdin> mechanism, never in argv, plans, or diagnostics. Never pass raw --password.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/apply.test.mjs (reported line 220)May include surrounding context.

js

});
test("password only travels through stdin, and missing executable is not success", (t) => {
  const f = fixture(t);
  let { r } = f.plan({ id: 1, title: "New" }, "secret.json", {
    CALIBRE_USERNAME: "user",
    CALIBRE_PASSWORD: "synthetic-secret",
  });

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill performs sensitive operations against Calibre metadata and explicitly relies on environment variables, local config, and potentially remote Calibre content-server endpoints, but it does not declare an explicit tool/permission scope. That increases the risk of overbroad execution in an agent framework because the runtime may grant broader env or network access than is necessary, making unintended credential exposure or unauthorized remote modification more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code defaults analysis rendering to Japanese via defaultLang = "ja", and this default propagates through record validation and input parsing unless the user explicitly supplies --lang en. This is a natural-language locale policy concern because the skill imposes a specific language by default rather than offering a neutral default or explicit opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says the skill is for edits to "title/authors/sort/series/tags/date/language/comments," which omits publisher, but the implementation explicitly treats "publisher" as a direct editable field and later applies it through calibredb. This is a real but limited semantic mismatch between the declared edit scope and the implemented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The inline comment on "reading_script" states it is a legacy preference and "never executed," but the code merely allows the field in config and otherwise ignores it. While the current implementation does not execute it, the comment asserts a stronger behavioral guarantee than the code actually enforces or validates elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/calibredb_apply.mjs:319

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/apply.test.mjs:59

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/state.test.mjs:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/calibredb_apply.mjs:254

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/apply.test.mjs:222