ClawHub
Back to skill

Security audit

Book Processor

Security checks for vulnerabilities and agentic risk

Overview

This EPUB-processing skill mostly does the advertised local book conversion, but it can unexpectedly request administrator-level package installation and leaves some automation boundaries unclear.

Review before installing. Use it only for EPUBs you intentionally provide, preinstall dependencies yourself, decline unexpected sudo prompts, and check for leftover /tmp/epub_extracted_* folders after failed runs. Static scan was clean and VirusTotal was pending; this Review verdict is based on the inspected artifacts, especially the runtime sudo install path and automatic execution boundaries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation describes file system access, environment/tool usage, and writing outputs under ~/workspace/books/, but it declares no permissions. This creates a transparency and policy-enforcement gap: an agent or platform may allow execution without clearly surfacing that the skill reads user files and writes multiple artifacts to disk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior does not match the analyzed behavior: the skill claims to process EPUBs and extract assets, but the analysis indicates it may attempt package installation with sudo, generate quality-assessment logic not disclosed to the user, and may not actually export the promised cover. Behavior/description mismatches are dangerous because they undermine informed consent and can hide privileged or unexpected actions from users and reviewers.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script escalates privileges to install jq with `sudo apt-get`, which is outside the expected scope of EPUB processing and modifies the host system. In an agent or automation context, this can trigger unauthorized package installation, expand attack surface, and violate least-privilege expectations.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The automation hook says the assistant should trigger processing whenever a file is received, but the documented workflow assumes an EPUB input and does not state any validation, confirmation, or file-type restriction at the trigger point. That makes the skill prone to unintended execution, file writes, and shell-script invocation on arbitrary uploads, which increases the risk of unsafe processing paths or abuse through crafted inputs.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README describes automatic creation of directories under `~/workspace/books/`, saving uploaded files, reading optional configuration, and executing `scripts/process_book.sh`, but it does not warn the user that these side effects happen automatically. This lack of disclosure can lead to unsafe consent boundaries and increases the chance that users trigger local file writes and shell execution without understanding the consequences.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script performs `sudo apt-get update && sudo apt-get install -y jq` after only a brief message and without explicit user confirmation. In unattended or agent-driven environments, this can unexpectedly change the system state with elevated privileges and execute network-backed package operations.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### 必需工具
| 工具 | 用途 | 安装命令 |
|------|------|----------|
| `jq` | JSON 配置解析 | `sudo apt-get install -y jq` |
| `python3` | 文本提取 | `sudo apt-get install -y python3` |
| `unzip` | EPUB 解压 | `sudo apt-get install -y unzip` |
Confidence
91% confidence
Finding
Including sudo apt-get install commands in a skill that may be followed or automated encourages privileged system modification outside the core EPUB-processing task. In agent or shared environments, privileged package installation can alter the host, expand the attack surface, and violate least-privilege expectations.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 工具 | 用途 | 安装命令 |
|------|------|----------|
| `jq` | JSON 配置解析 | `sudo apt-get install -y jq` |
| `python3` | 文本提取 | `sudo apt-get install -y python3` |
| `unzip` | EPUB 解压 | `sudo apt-get install -y unzip` |

### 验证安装
Confidence
91% confidence
Finding
The documented sudo install of python3 likewise normalizes privileged execution for dependency setup. Even if presented as installation guidance, such instructions are risky in a skill context because users or automation may execute them verbatim, leading to unnecessary root-level changes on the host.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 问题 | 原因 | 解决 |
|------|------|------|
| `jq 未安装` | 缺少依赖 | `sudo apt-get install -y jq` |
| `unzip: command not found` | 缺少解压工具 | `sudo apt-get install -y unzip` |
| `未找到 epub 文件` | 文件夹内无 `.epub` 文件 | 确保 EPUB 文件已放入书籍文件夹 |
| 生成文件为空 | EPUB 为图片格式 | 手动补充 `summary.txt` 和 `framework_article.txt` |
Confidence
89% confidence
Finding
Repeating sudo-based remediation in troubleshooting increases the likelihood that operators will run privileged commands during normal failure handling. This is especially risky in agent ecosystems where recovery steps may be copied into automated flows without human review.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 问题 | 原因 | 解决 |
|------|------|------|
| `jq 未安装` | 缺少依赖 | `sudo apt-get install -y jq` |
| `unzip: command not found` | 缺少解压工具 | `sudo apt-get install -y unzip` |
| `未找到 epub 文件` | 文件夹内无 `.epub` 文件 | 确保 EPUB 文件已放入书籍文件夹 |
| 生成文件为空 | EPUB 为图片格式 | 手动补充 `summary.txt` 和 `framework_article.txt` |
Confidence
89% confidence
Finding
This troubleshooting guidance again recommends privileged package installation, which is unnecessary for the core logic of processing a user-supplied EPUB and broadens operational risk. In context, the danger is elevated because the skill is designed for automatic triggering on uploaded files, so operators may be tempted to embed these commands into unattended setup or repair workflows.

Static analysis

No suspicious patterns detected.