book-capture-obsidian

• Outcome: Pass
• Latest audit: Oct 25, 2026 · 6:01 PM UTC
• Version: 1.3.5

Overview

The skill’s book-cataloguing tools, local note updates, and disclosed online lookups fit its stated purpose.

Back up your vault, review the dry run, and try a small import first. Generated sections are rewritten; keep personal content under “User Notes.” Online enrichment shares book identifiers or titles and authors with the documented providers. Use --no-enrich for a local-only Goodreads import.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_isbn.py (reported line 30)May include surrounding context.

python

warnings: List[str] = []
    values: List[str] = []
    try:
        run = subprocess.run(
            [binary, "--quiet", image_path],
            check=False,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_isbn.py (reported line 127)May include surrounding context.

python

for config in configurations:
        try:
            run = subprocess.run(
                [binary, image_path, "stdout", "-l", lang, *config],
                check=False,
                capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_ci_gate.py (reported line 19)May include surrounding context.

python

copied_ci = isolated_scripts / "run_ci_local.sh"
    shutil.copyfile(repository_root / "scripts" / "run_ci_local.sh", copied_ci)

    run = subprocess.run(
        ["sh", str(copied_ci)],
        check=False,
        capture_output=True,

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · tests/test_google_books.py (reported line 61)May include surrounding context.

python

requested_isbn=ISBN,
        api_key=SENTINEL,
        request_get=fake_get,
        max_retries=0,
    )

    assert captured["url"] == google_books.GOOGLE_BOOKS_URL

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · tests/test_metadata_resolver.py (reported line 159)May include surrounding context.

python

assert next_run.stats.google_skipped_cooldown == 1

    clock.t += 3601
    after_cooldown = make_resolver(fake_get, clock, MetadataCache(path, now=clock.now), google_max_retries=0)
    after_cooldown.lookup(isbn13="9780131103627")
    assert len([url for url in log if "googleapis" in url]) == 3

Static analysis

No suspicious patterns detected.