Security audit

Book-PDF：书籍级PDF手册生成器

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real PDF-book workflow, but its local scripts have unsafe input handling and mutable external dependencies that users should review before installing.

Install only if you are comfortable with a Chinese-localized, shell-based local PDF workflow. Run it in a dedicated project directory, avoid untrusted titles/metadata/update messages, pin Playwright with a lockfile before use, and consider removing remote font imports or blocking network access during PDF rendering.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: templates/update.sh:49
Finding: Arbitrary JavaScript Execution Through the Changelog Message
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/build.js:12
Finding: Arbitrary File Write Through Path Traversal in the Book Title
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/build.js:38
Finding: Unescaped Metadata Injection Into the Playwright Rendering Context
Content: View full analysis
{ let result = template; // Process conditional blocks {{#KEY}}...{{/KEY}} result = result.replace(/\{\{#(\w+)\}\}([\s\S]*?)\{\{\/\1\}\}/g, (match, key, inner) => { const value = data[key]; if (!value) return ''; // Replace internal {{KEY}} return inner.replace(new RegExp(`\\{\\{${key}\\}\\}`, 'g'), value); }); // Process simple placeholders {{KEY}} Object.keys(data).forEach(key => { result = result.replace(new RegExp(`\\{\\{${key}\\}\\}`, 'g'), data[key] || ''); }); return result; }; ``` The replacement data is taken directly from project metadata: ```js const backpageData = { BOOK_TITLE: versionData.title || '', BOOK_SUBTITLE: author.subtitle || '', AUTHOR_NAME: author.name || '', AUTHOR_BIO: author.bio || '', AUTHOR_QR_IMAGE: author.qrImage || '', AUTHOR_LINK_URL: author.linkUrl || '', AUTHOR_LINK_TEXT: author.linkText || '', AUTHOR_SOCIAL: author.social || '', VERSION: versionData.version || '1.0.0', YEAR: new Date().getFullYear() }; ``` For example, the values are placed directly into HTML element and attribute contexts: ```html
{{AUTHOR_NAME}}
{{AUTHOR_BIO}}
{{AUTHOR_LINK_TEXT}} ``` The generated document is then opened by Playwright: ```js const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(`file://${HTML_FILE}`, { waitUntil: 'networkidle', timeout: 60000 }); ``` ### Technical Analysis The custom template replace ...[truncated 2317 chars]
Remediation: View remediation
', '>') .replaceAll('"', '"') .replaceAll("'", '''); } ``` Example URL validation: ```js function validateWebUrl(value) { if (!value) return ''; const parsed = new URL(value); if (!['https:', 'http:'].includes(parsed.protocol)) { throw new Error(`Unsupported URL scheme: ${parsed.protocol}`); } return parsed.href; } ``` Playwright can also disable script execution and restrict requests: ```js const context = await browser.newContext({ javaScriptEnabled: false }); const page = await context.newPage(); await page.route('**/*', route => { const url = route.request().url(); if (url.startsWith('file://')) { return route.continue(); } return route.abort(); }); ``` If remote fonts are required, download and pin them as local assets instead of permitting unrestricted rendering-time network access. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Playwright Installation Creates Supply-Chain Exposure
Content: View full analysis
= 16 - Playwright: `npm install playwright && npx playwright install chromium` ``` The initialization script recommends the same commands: ```bash echo " ⚠️ 未找到 Playwright — 请运行:" echo " npm install playwright" echo " npx playwright install chromium" ``` ### Technical Analysis The documented installation procedure does not specify an exact Playwright version and the project contains no reviewed lockfile or integrity-pinned dependency manifest. Running `npm install playwright` therefore resolves the package version from mutable registry metadata at installation time. The subsequent `npx playwright install chromium` command executes the installed Playwright CLI and downloads a browser build selected by that package version. Consequently, the effective dependency and browser payload can differ between installations even when the audited project files remain unchanged. This is a supply-chain hardening weakness rather than evidence that the current Playwright package is malicious. The risk arises because future, compromised, or unexpectedly incompatible package content would be installed and executed without being represented in the audited repository. ### Attack Path 1. A user follows the project’s dependency installation instructions. 2. npm resolves the current version of `playwright` rather than an exact reviewed version. 3. npm downloads the package and processes any applicable package installation behavior. 4. The user runs the Playwright CLI through `npx`. 5. The CLI downloads and installs a Chromium build selected by the resolved package. 6. If the registry package, package account, distribution ...[truncated 683 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 描述强调的是一个端到端的“从调研到规划到多Agent写作再到合并构建和PDF生成”的完整书籍级手册生产能力。但实际代码片段只负责初始化一个本地项目骨架，包括创建 fragments/output/versions/research 目录、复制 build/build-pdf/update 等模板、写入版本与计划模板，并检查 Playwright 依赖。它没有执行调研、没有调用任何多Agent机制、没有生成内容、没有合并构建HTML或渲染PDF，甚至输出中明确要求用户后续手动编辑 PROJECT.md、build.js 和 fragments 内容。因此当前代码行为与声明的主要能力存在实质性不一致；实际更像“书籍PDF项目脚手架初始化器”，而不是完整的书籍级PDF手册生成技能。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个端到端的“从调研到成书”的完整书籍级 PDF 手册生成技能，而提供的代码片段只负责将已存在的合并后 HTML 文件转为 PDF。代码明确写明前置条件是“先运行 node build.js 生成 HTML”，说明它不承担调研、写作、规划、合并生成等核心职责。虽然声明中提到最终会使用 Playwright 渲染 PDF，这与代码一致，但该代码的实际主功能明显窄于声明的整体能力范围，且更像是独立的 PDF 渲染子模块。因此，描述与该代码片段的实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个端到端的“从零到书籍级PDF手册”的复杂生成系统，核心能力包括研究、写作编排、版本管理和Playwright导出PDF。实际代码块只覆盖其中很小的一部分：基于version.json和固定片段顺序构建HTML，并做少量模板变量替换。这属于支持性的构建步骤，而不是声明中的主要功能。尤其是代码没有任何网络检索、内容生成、多代理协作、任务编排或PDF输出逻辑，因此实际行为与声明的主要目的存在明显不一致。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases include very broad everyday language such as '做一本书' and similar generic requests, which can cause accidental activation in unrelated contexts. Because this skill includes shell usage, initialization scripts, dependency installation, and file-generation workflows, overbroad triggering increases the chance of unintended tool execution and workspace modifications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs use of shell commands (bash, node, npx playwright) but declares no explicit tool scope or permission boundary. In an agent environment, this can cause the skill to be invoked with broader shell capability than intended, increasing the risk of unintended command execution or file-system changes if the workflow is triggered on untrusted input.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx playwright without pinning a version introduces supply-chain and reproducibility risk because the resolved package version can change over time. If a compromised or unexpected version is fetched, the skill may execute different code than reviewed, including during browser install steps.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file title and core instruction text are written as a required reference for a writing agent, and the guidance assumes Chinese output conventions while embedding English only as fixed subtitle fields. There is no indication that the user can opt into another language or locale, which can violate language-choice policy for general-purpose skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template hard-codes Chinese placeholder and metadata text such as the title, subtitle, and document fields, which imposes a specific language by default. There is no accompanying note that this fragment is intended only for a Chinese-language or region-specific workflow, nor any indication that users can select another locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content embedded in comments and generated labels such as '核心建议', '注意', '推荐', and '不推荐' indicates the skill is designed to produce Chinese-language presentation by default. The policy requires not forcing a specific language or locale without user opt-in, and no opt-in or alternative locale path is documented in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script includes its usage instructions and operational messages in Chinese only, which imposes a specific language on users without any opt-in or stated regional justification. The policy specifically calls for flagging language or locale constraints when the skill forces a language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's comments, usage strings, prompts, and status messages are all written in Chinese, which effectively fixes the skill's user-facing language. Under the policy, locale or language constraints should either be optional for the user or clearly documented as justified; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file's header comments and runtime console messages are written in Chinese, which imposes a specific language on users without any opt-in or documented locale constraint. This matches the policy category for language or locale restrictions expressed in natural language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script formats build time using the fixed locale 'zh-CN' and timezone 'Asia/Shanghai'. This is a natural-language/locale policy concern because it forces a specific locale choice without offering user selection or explaining why that locale is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The alt text uses Chinese ("二维码") directly in the template, which imposes a specific language in user-facing output. The policy allows fixed locale behavior only when it is opt-in or clearly documented as region-specific, which is not evident in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This line contains a full Chinese disclaimer presented to end users, but the template provides no indication that Chinese is optional or that the skill is intentionally limited to that locale. That creates a natural-language locale policy concern under the language-choice rule.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The stylesheet imports Google Fonts from a remote origin, which causes network access during rendering and leaks metadata such as IP address, timing, and document-generation behavior to a third party. In a local HTML/PDF generation skill, this is unnecessary for core functionality and weakens privacy, reproducibility, and offline safety.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Using an external font service silently transmits requests to Google without disclosure, which creates an avoidable privacy issue and may violate strict offline or regulated environments. Because this is a PDF-rendering template rather than a web app feature, the third-party dependency is not justified by the immediate task.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.