EPUB retailer preflight

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for EPUB preflight, but it should be reviewed before installation because its setup path is unpinned and it sends EPUB files to a third-party MCP service.

Install only if you trust PowMCP with the EPUB bytes or direct public EPUB URL being checked. Avoid authenticated URLs, secrets, and query-string tokens. Prefer a pinned installer or reviewed commit if available, and run setup from an environment without production credentials or unrelated confidential files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned Third-Party Installer Permits Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 41
Vulnerability Type: Unpinned executable dependency and mutable remote Skill source
Risk Level: Medium

Vulnerable Code:

sh

npx skills add powmcp/skills --skill preflight-retailer-bound-epub

Technical Analysis

The documented setup command invokes npx without pinning the skills package to an audited version. Depending on the local environment and cache state, npx may download and execute the package currently published under that name.

The powmcp/skills source is also identified by a mutable repository reference rather than an immutable commit. Therefore, both the installer behavior and installed Skill content can change after this project has been audited.

This creates a supply-chain trust boundary in which externally controlled code or instructions may execute with the invoking user's permissions. No evidence shows that the current dependencies are malicious; the vulnerability is the absence of integrity and version controls capable of preventing future substitution.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or mutable powmcp/skills repository.
2. The attacker publishes a malicious version of the installer or modifies the remotely retrieved Skill content.
3. A user follows the documented setup instruction.
4. npx downloads and executes the current package, or the installer retrieves the modified Skill source.
5. The malicious installer runs with the user's current privileges or installs attacker-controlled instructions for subsequent Agent use.

Impact Assessment

Successful exploitation could execute arbitrary commands with the privileges of the user running npx. Depending on that user's access, the attacker could read or modify accessible files, obtain environment variables or credentials, make network requests, alter installed Agent instructions, or inst ...[truncated 355 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to an exact audited version, for example by using npx --package=skills@<exact-version>.
2. Pin powmcp/skills to an immutable commit identifier rather than a mutable branch or default repository reference.
3. Record and verify cryptographic hashes for downloaded installation artifacts and Skill content.
4. Review npm lifecycle scripts and prefer an installation method that does not execute unnecessary scripts.
5. Use lockfiles and integrity metadata where the installation mechanism supports them.
6. Execute installation in a restricted environment without production credentials or access to confidential publishing assets.
7. Document the expected package version, repository commit, publisher identity, and verification procedure so users can detect unexpected upstream changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill instructs users to install and run tooling via npx skills add powmcp/skills --skill preflight-retailer-bound-epub without pinning an exact package version. This creates a supply-chain risk because future package updates or a compromised upstream release could change the code fetched and executed at install/runtime, leading to unreviewed behavior in the user's environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

Tell the user the call can take up to 110 seconds. Call `powmcp-epub-check:ebook_check` once for the upload candidate.

Provide either `url` or `file`, not both. For an attachment up to 25 MB, pass it through `file`; do not ask the user to host it. Set `maxMessages` only when needed, from 1 to 500; the default is 200.

If invalid arguments identify a failing field, correct that field and call again. Do not treat that response as a missing tool.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables implicit invocation without any visible trigger scoping or activation constraints, which increases the chance the agent will call an external MCP service automatically in situations the user did not explicitly intend. Because this skill connects to a remote tool over streamable HTTP, over-broad auto-invocation can expose sensitive file paths, document contents, or metadata to a third-party service and expands the attack surface for prompt- or context-driven misuse.

Content

No source excerpt is available for this finding.