ClawHub
Back to skill

Security audit

Bestseller Writer

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but users should understand it can spend API credits, send manuscript content to Anthropic, and create many local files.

Install only if you are comfortable sending book ideas and generated manuscript material to Anthropic and paying for the resulting API calls. Use an explicit output directory, avoid sensitive unpublished or personal material unless acceptable under your Anthropic account terms, and prefer pinning dependencies with a lockfile before running npm install.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:9
Finding

Mutable npm Dependency Installed Without a Lockfile

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.js:26
Finding

Unvalidated Workload Arguments Permit Denial of Service and Excessive API Spending

Content
View full analysis
batch + i + 1); console.log(` 📝 Writing chapters ${batchNums[0]}-${batchNums[batchNums.length - 1]}...`); const results = await Promise.all(batchNums.map(async (chNum) => { const prevChapterPath = path.join(OUTPUT_DIR, `chapter_${String(chNum - 1).padStart(2, '0')}.md`); const prevChapter = fs.existsSync(prevChapterPath) ? fs.readFileSync(prevChapterPath, 'utf8').slice(-1500) : ''; const outline = chapterOutlines[chNum - 1] || `Chapter ${chNum}`; const content = await runAgent(client, MODEL_WRITER, buildChapterPrompt(plan, characters, chNum, CHAPTERS, outline, prevChapter, GENRE)); return { chNum, content }; })); ``` ### Technical Analysis The `--chapters` and `--batch` arguments are parsed as integers but are not checked for finiteness, positivity, or safe upper bounds. A `BATCH_SIZE` of zero prevents the loop counter from advancing because `batch += BATCH_SIZE` repeatedly adds zero. Negative values can similarly cause non-terminating behavior. Very large positive chapter or batch values can generate excessive paid Anthropic API requests, consume memory through `Promise.all`, and produce large numbers of local files. The issue is locally triggerable through CLI arguments. It becomes more significant if another agent, automation service, or web-facing wrapper constructs these arguments from untrusted input. ### Attack Path **Denial-of-service path:** 1. An attacker or untrust ...[truncated 1339 chars]
Remediation
View remediation
max) { throw new Error(`${name} must be an integer between ${min} and ${max}`); } return parsed; } const CHAPTERS = parseBoundedInteger(args.chapters ?? '25', '--chapters', 1, 100); const BATCH_SIZE = parseBoundedInteger(args.batch ?? '4', '--batch', 1, 10); ``` Additional hardening should include: 1. Enforce a maximum estimated request count and obtain confirmation before expensive runs. 2. Cap API concurrency independently of user-controlled arguments. 3. Add request timeouts, retry limits, and an overall spending or token budget. 4. Reject zero, negative, non-integer, non-finite, and unsafe integer values. 5. Handle API rate-limit and partial-generation failures cleanly. 6. If exposed through an agent or service, apply authorization, per-user quotas, and server-side fixed limits rather than trusting caller-supplied values. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md
Task: Full planning prompt (see scripts/generate.js `buildPlannerPrompt`)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation phrase "Write me a book about [your idea]" is extremely broad and closely resembles normal user conversation, making accidental or unintended triggering likely in an agent environment. Because this skill launches a high-cost, autonomous multi-stage content generation workflow, a casual phrase could cause unexpected API usage, long-running tasks, or publication-oriented actions without explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The environment section asks the user to export ANTHROPIC_API_KEY but does not explicitly warn that the skill will use that credential to make external API calls throughout the multi-agent pipeline. In context, the workflow generates many stages and parallel chapter jobs, so users may incur unexpected outbound data sharing and usage charges if they do not realize their key will be used automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are extremely broad (e.g. 'Write me a book about [idea]' / 'Generate a bestseller about [idea]') and are likely to match ordinary conversational requests, causing the agent to enter an autonomous workflow without explicit confirmation. In this skill, that workflow leads to file creation, parallel subagent spawning, and downstream API-backed content generation, so accidental activation can produce unintended actions and costs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to create an output directory and write multiple files under ~/Desktop/books/[slug]/ without an upfront user warning or approval gate. Because this is in agent-orchestrated mode triggered by ordinary writing requests, it can modify the local filesystem unexpectedly and at scale as part of a multi-step autonomous pipeline.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script sends user-supplied ideas, generated plans, character profiles, chapter text, and editorial content to Anthropic via client.messages.create without any explicit notice, consent flow, or data minimization. In a long-form book-generation workflow, this can expose sensitive unpublished manuscripts, proprietary business ideas, memoir details, or personal data to a third-party API, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script imports execSync from child_process, which would enable shell command execution, but the advertised purpose is generating and packaging book content via an LLM pipeline. Shell execution is not justified by the stated manuscript-generation scope, and no code in this file uses it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency uses a caret range (^0.39.0) instead of an exact pinned version, which permits installation of different releases over time. That weakens build reproducibility and can inadvertently pull in a vulnerable or breaking SDK version, which is more concerning here because this skill is an autonomous content-generation pipeline likely to handle API keys and file operations.

Content

Scanner excerpt · scripts/package.json (reported line 10)May include surrounding context.

json
"generate": "node generate.js"
  },
  "dependencies": {
    "@anthropic-ai/sdk": "^0.39.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: @anthropic-ai/sdk has 2 known advisory(ies) (CVE-2026-34451 (Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to ); CVE-2026-41686 (Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesys)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The manifest references @anthropic-ai/sdk without an exact pin, and the package has known advisories affecting some releases, so the actual installed version may be vulnerable without visibility from the manifest alone. In this skill context, the SDK is central to an autonomous multi-agent workflow and may interact with local files or tooling, which increases the practical risk of any SDK sandbox-escape or insecure-permission issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.