ClawHub
Back to skill

Security audit

Book Writer

Security checks across malware telemetry and agentic risk

Overview

This book-writing skill mostly matches its stated purpose, but it needs review because some file writes are not safely confined and the installer upgrades unpinned packages.

Install only in a virtual environment, review the dependency list before running the installer, and avoid using sensitive prompts or manuscripts unless you are comfortable sending them to OpenAI/Google. Treat output paths as trusted input, and prefer normal filenames under generated_books until the skill adds path normalization and download limits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(f"   💻 执行: {cmd}")

    try:
        result = subprocess.run(cmd, shell=True, check=True,
                              capture_output=True, text=True)
        if result.returncode == 0:
            print(f"   ✅ 成功")
Confidence
95% confidence
Finding
The script executes shell commands via subprocess.run(..., shell=True), which is dangerous because shell parsing enables command injection if any part of cmd becomes attacker-controlled now or in future modifications. Although this file currently builds cmd from hardcoded package names and sys.executable, using shell=True in an installer materially increases risk because installers are often run with elevated privileges and are common extension points for later user-supplied inputs.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and documents capabilities to access environment variables, read/write files, use the network, and invoke shell commands, but does not declare permissions or boundaries for those actions. In an agent ecosystem, undeclared powerful capabilities reduce transparency and consent, making it easier for the skill to overreach, expose secrets, or execute unintended operations during normal use.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior goes beyond a simple writing assistant: it installs dependencies, inspects API key configuration, performs external searches, and downloads remote content. This mismatch is dangerous because users may invoke the skill expecting local content generation while it actually executes commands and transmits data externally, increasing the risk of supply-chain issues, secret exposure, and unsafe content ingestion.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The file performs live external searches and arbitrary internet downloads, which expands the skill's trust boundary beyond simple AI-assisted book outlining/expansion. In this context, that creates privacy, supply-chain, and content-integrity risks because user prompts may be sent to third parties and remote content can be fetched and written locally without strong validation.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill instructs users to provide API keys and use network-based material search, but does not warn that prompts, search terms, or generated-book context may be transmitted to external providers. This creates privacy and compliance risk, especially if users include proprietary manuscripts, research notes, or sensitive content in prompts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
User-provided prompts and chapter context are sent to an external OpenAI API without any explicit notice, consent flow, or data-classification check in this file. If users provide sensitive manuscript content, proprietary material, or personal data, that information may be disclosed to a third party unexpectedly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The download_image method retrieves attacker-controlled remote content and writes it directly to a caller-supplied filesystem path with no confirmation, allowlisting, path safety checks, size limits, timeout, or content validation. This can enable unsafe file writes, disk consumption, and persistence of malicious or unexpected content if higher-level code exposes these parameters to users or untrusted inputs.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
available_keys = []
    for key, description in api_keys:
        value = os.environ.get(key)
        if value:
            masked_value = value[:4] + "..." + value[-4:] if len(value) > 8 else "***"
            print_result(description, True, f"已设置 ({masked_value})")
Confidence
89% confidence
Finding
The script enumerates sensitive environment variables and prints partially masked values to stdout. Even though the keys are masked, this still confirms which secrets are present and leaks secret structure/prefix/suffix information into terminal logs, CI logs, or shared support output, which can aid attackers and increase exposure in multi-user or logged environments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
pyyaml>=6.0
python-dotenv>=0.19.0
Confidence
95% confidence
Finding
The dependency is specified with a lower-bound range instead of an exact version, which makes builds non-reproducible and can introduce unexpected vulnerable or breaking releases over time. This is a real supply-chain hygiene issue, though by itself it does not prove exploitation.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
pyyaml>=6.0
python-dotenv>=0.19.0
tiktoken>=0.3.0
Confidence
98% confidence
Finding
`requests>=2.28.0` is unpinned, so installations may resolve to different versions across environments, including versions affected by known advisories. Because `requests` is network-facing and commonly used for authentication and outbound HTTP, version drift increases real security exposure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
pyyaml>=6.0
python-dotenv>=0.19.0
tiktoken>=0.3.0
beautifulsoup4>=4.11.0
Confidence
98% confidence
Finding
`pyyaml>=6.0` allows any later release and does not guarantee use of a known-safe version set in all environments. Since YAML parsers are frequently exposed to untrusted content in AI workflows and content-generation tools, unpinned resolution increases the chance of pulling an unsafe or incompatible build.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
pyyaml>=6.0
python-dotenv>=0.19.0
tiktoken>=0.3.0
beautifulsoup4>=4.11.0
lxml>=4.9.0
Confidence
90% confidence
Finding
`python-dotenv>=0.19.0` is not pinned, so deployments may receive different versions with different security properties. While lower risk than a parser or HTTP client, it still weakens supply-chain control and can expose the project to avoidable vulnerable releases.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
pyyaml>=6.0
python-dotenv>=0.19.0
tiktoken>=0.3.0
beautifulsoup4>=4.11.0
lxml>=4.9.0
Confidence
88% confidence
Finding
`tiktoken>=0.3.0` is unpinned, which permits uncontrolled upgrades and undermines reproducibility. This is primarily a supply-chain stability and hygiene issue unless a specific downstream vulnerability is known.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyyaml>=6.0
python-dotenv>=0.19.0
tiktoken>=0.3.0
beautifulsoup4>=4.11.0
lxml>=4.9.0
Confidence
90% confidence
Finding
`beautifulsoup4>=4.11.0` is unpinned, allowing version drift between environments. In content-processing tools this can indirectly affect security if parser behavior changes or vulnerable transitive combinations are installed.

Unpinned Dependencies

Low
Category
Supply Chain
Content
python-dotenv>=0.19.0
tiktoken>=0.3.0
beautifulsoup4>=4.11.0
lxml>=4.9.0
Confidence
97% confidence
Finding
`lxml>=4.9.0` is unpinned and `lxml` is a high-risk parsing library with a history of security issues. Allowing arbitrary later versions without controlled review increases the chance of shipping a vulnerable parser or inconsistent parser behavior.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
The requirements file permits installation of `requests` versions associated with multiple advisories, and the current spec does not constrain the package to a known-patched release. In a writing skill that may fetch remote content or APIs, a vulnerable HTTP client can expose credentials, mishandle redirects, or weaken request security.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical
Category
Supply Chain
Confidence
96% confidence
Finding
The requirements allow `PyYAML` versions with known deserialization and input-validation issues, and YAML parsing bugs can lead to code execution or unsafe object construction when processing untrusted input. For an AI-assisted content-generation skill that may ingest configuration or user-supplied data, this materially increases risk if YAML is parsed anywhere in the skill.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
76% confidence
Finding
`python-dotenv` has an advisory related to symlink-following during `set_key`, and the unbounded requirement does not ensure a patched version. This is only exploitable if the skill writes `.env` files in attacker-influenced paths, so the direct risk from the requirements alone is limited but real.

Known Vulnerable Dependency: lxml — 10 advisory(ies): CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +7 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
The file permits `lxml` versions with known parser and sanitizer-related vulnerabilities, including issues that can enable XSS or unsafe handling of crafted HTML/XML. Because this skill may process web or document content for book generation, a vulnerable parsing library is especially relevant and increases the risk from untrusted input.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.