Opdscli

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:04 PM UTC
• Version: 0.1.0

Overview

This skill is a straightforward OPDS ebook CLI helper with disclosed local downloads and credential-storage caveats, though users should understand the third-party install and plaintext config risks.

Install only if you trust the opdscli Homebrew tap and the OPDS catalogs you configure. Avoid reusing important passwords, prefer narrowly scoped or revocable tokens where available, and do not share or back up ~/.config/opdscli.yaml without removing secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Installation from a Mutable Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4`; `references/cli-reference.md:3-7` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"📚","requires":{"bins":["opdscli"]},"install":[{"id":"brew","kind":"brew","tap":"rafadc/opdscli","formula":"opdscli","bins":["opdscli"],"label":"Install opdscli (brew)"}]}} ``` `references/cli-reference.md:3-7`: ```markdown ## Installation ```bash brew tap rafadc/opdscli brew install opdscli ``` ``` ### Technical Analysis The installation workflow trusts the mutable `rafadc/opdscli` third-party Homebrew tap without pinning a reviewed commit, package version, release artifact, or checksum. The tap identity is consistent with the project homepage, and there is no evidence that it is currently malicious. Nevertheless, the package that users receive can change after this Skill has been reviewed. Homebrew formulas and associated installation artifacts can execute build or installation logic with the privileges of the invoking user. Consequently, compromise of the upstream repository, maintainer account, release infrastructure, or referenced artifacts could turn the documented installation command into a remote code execution path. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an artifact referenced by its formula. 2. The attacker modifies the formula or distributed package to include malicious installation or runtime behavior. 3. A user follows the Skill metadata or CLI reference and runs `brew tap rafadc/opdscli` followed by `brew install opdscli`. 4. Homebrew retrieves the mutable attacker-controlled version. 5. The malicious package executes during installation or later when the agent invokes `opdscli`. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running Homebrew or `opdsc ...[truncated 363 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to a reviewed `opdscli` release and, where Homebrew permits, a specific reviewed tap commit or immutable artifact. 2. Publish and verify a cryptographic checksum for downloaded release artifacts. 3. Prefer a trusted central package repository with established review and provenance controls when one is available. 4. Document the expected package version and provide a command for users to confirm the installed version before use. 5. Consider artifact signing or provenance attestations, and require signature verification before installation. 6. Periodically review the pinned release and update it through a controlled dependency-review process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Catalog Passwords and Bearer Tokens Are Stored in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-35,50-51`; `references/cli-reference.md:99-117` **Vulnerability Type**: Plaintext storage of authentication credentials **Risk Level**: Medium ### Vulnerable Code `SKILL.md:29-35`: ```bash # Basic auth (will prompt for credentials) opdscli catalog add mylib https://my-library.example.com/opds --auth-type basic # Bearer token opdscli catalog add mylib https://my-library.example.com/opds --auth-type bearer ``` `SKILL.md:50-51`: ```markdown - Config lives at `~/.config/opdscli.yaml`. Do not edit it directly; use `opdscli catalog` subcommands. - Credentials stored in config are plaintext. Never log or echo catalog config that may contain passwords or tokens. ``` `references/cli-reference.md:99-117`: ```markdown ## Configuration Config file: `~/.config/opdscli.yaml` ```yaml default_catalog: mylib catalogs: mylib: url: https://my-library.example.com/opds auth: type: basic username: user password: pass public: url: https://public.example.com/opds settings: default_format: epub ``` File permissions are set to `600`. Do not manually edit — use `opdscli catalog` subcommands. ``` ### Technical Analysis The documented authenticated-catalog workflow accepts Basic Authentication passwords and bearer tokens and explicitly states that credentials are stored in plaintext in `~/.config/opdscli.yaml`. File mode `600` is a useful access-control measure because it prevents direct reading by other local users under normal permissions. It does not encrypt the secrets or protect them from processes running as the same user, account compromise, insecure backups, accidental file publication, or tools that collect the user's home-directory contents. The instruction not to log or echo the configuration reduces accidental disclosure but does not address disclosure through direct file access. Bearer tokens are especially sensitive because possession may be sufficient for auth ...[truncated 1435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store passwords and bearer tokens in the operating system's credential store, such as macOS Keychain, and retain only a credential identifier in `opdscli.yaml`. 2. If a native credential store is unavailable, integrate with a dedicated secret manager rather than storing reusable secrets directly in YAML. 3. Preserve restrictive file permissions as defense in depth, but do not treat mode `600` as a substitute for secret storage. 4. Ensure verbose and error output always redacts authorization headers, passwords, bearer tokens, and sensitive URL parameters. 5. Provide commands to rotate and remove stored credentials, and recommend short-lived, narrowly scoped tokens where the OPDS service supports them. 6. Warn users not to include `~/.config/opdscli.yaml` in backups, support bundles, shell output, or shared archives unless sensitive fields have been removed. 7. Replace realistic plaintext credential examples with explicitly marked placeholders and clarify that secrets should never be entered directly into manually edited configuration files. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: This markdown file documents a command that downloads books and allows specifying an output directory, which affects user storage and local files. The examples describe usage but do not include any user-facing warning about file creation or where files will be saved by default.