clawdible -audiobooks

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:55 PM UTC
• Version: 1.0.1

Overview

This Audible skill mostly does what it says, but it needs review because it stores reusable account login material locally and auto-installs unpinned Python packages while supporting purchases.

Install only if you are comfortable with an unofficial Audible integration that can read your library, change your wishlist, and make purchases after confirmation. Review or preinstall pinned dependencies in a controlled environment before running it, and treat ~/.config/audible/auth.json as a sensitive login secret that should be protected, excluded from unsafe backups, and removed if you stop using the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/audible_auth.py:19

Finding

Runtime Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/audible_auth.py:19-38
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python

def ensure_deps():
    missing = []
    for pkg in ["audible", "httpx"]:
        try:
            __import__(pkg)
        except ImportError:
            missing.append(pkg)
    if missing:
        print(f"Installing missing dependencies: {', '.join(missing)}...")
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet"] + missing
            )
            print("Dependencies installed.\n")
        except subprocess.CalledProcessError as e:
            print(f"ERROR: Failed to install dependencies: {e}")
            print(f"Run manually: pip3 install {' '.join(missing)}")
            sys.exit(1)

ensure_deps()

An equivalent dependency installation routine also appears in scripts/audible_cli.py:27-46.

Technical Analysis

Both executable scripts automatically install audible and httpx from the Python package index when imports fail. The dependency names have no version constraints or integrity hashes, and the project contains no lockfile. Installation is performed at runtime in the active Python environment without an explicit approval step or package isolation.

Consequently, the code ultimately executed by the skill can differ from the code that was audited. A compromised upstream release, package-index account, or dependency chain could introduce arbitrary code. Python package installation and import mechanisms may execute package-controlled code with the same operating-system privileges as the skill process. This is especially sensitive because the process can access locally stored Audible authentication material.

Attack Path

1. An attacker compromises a declared package, one of its transitive dependencies, or its distribution channel.
2. The attacker publishes a malicious release under t ...[truncated 1004 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic package installation from both runtime entry points.
• Declare reviewed, exact dependency versions in a dedicated dependency manifest.
• Generate a lockfile and require package hashes, such as with pip hash-checking mode.
• Install dependencies during a separate, explicit, user-approved setup phase.
• Use a dedicated virtual environment rather than modifying the active interpreter environment.
• Review and pin transitive dependencies in addition to direct dependencies.
• Add automated dependency vulnerability and provenance scanning.
• Fail safely with installation instructions when dependencies are unavailable instead of silently installing them.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audible_auth.py:127

Finding

Audible Authentication Credentials Stored Without Encryption

Content

View full analysis

Vulnerability Details

File Location: scripts/audible_auth.py:127-129
Vulnerability Type: Plaintext storage of reusable authentication material
Risk Level: Medium

Vulnerable Code

python

CONFIG_DIR.mkdir(parents=True, exist_ok=True)
auth.to_file(AUTH_FILE, encryption=False)
AUTH_FILE.chmod(0o600)

Technical Analysis

The authentication object is explicitly serialized with encryption=False to ~/.config/audible/auth.json. The subsequent chmod(0o600) is a useful access-control measure, but it does not encrypt the credentials. Reusable token and device authentication material therefore remains readable to any process operating under the same user account, to software with elevated privileges, and potentially through unprotected backups or accidental file disclosure.

Because the skill supports authenticated account reads, wishlist modification, and purchases, disclosure of this authentication material could allow an attacker to impersonate the user within the capabilities and lifetime of the stored credentials.

Attack Path

1. The user completes Audible authentication.
2. The script writes the authenticator to ~/.config/audible/auth.json without encryption.
3. A malicious or compromised process running as the same operating-system user reads the file; alternatively, the file is exposed through an insecure backup or accidental copy.
4. The attacker extracts the reusable authentication and device material.
5. The attacker loads or reproduces the Audible authenticator and submits authenticated requests.
6. The attacker accesses account data or attempts account-changing operations supported by the credentials.

Impact Assessment

The primary impact is compromise of the user's Audible session and associated account data. An attacker may gain access to library information, account-related API data, and wishlist functionality. Given that the skill also implements an order endpoint, stolen credentials may facilitate unauthor ...[truncated 216 chars]

Remediation

View remediation

Remediation Suggestions

• Store authentication secrets in the operating system's credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux Secret Service implementation.
• If the Audible library supports encrypted authenticator files, enable encryption and protect the decryption secret separately from the credential file.
• Retain restrictive owner-only file permissions as defense in depth.
• Create sensitive files atomically with restrictive permissions rather than relying solely on a post-write chmod.
• Exclude credential and state files from backups, synchronization systems, logs, and support bundles unless those systems provide appropriate encryption.
• Document credential revocation and device deregistration procedures.
• Minimize stored credential lifetime and scope where supported, and rotate credentials after suspected disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad Audible management skill with user-facing capabilities for search, library access, purchases, and wishlist management. The actual code chunk does not perform any of those operations. It solely handles authentication setup by creating an OAuth URL, processing the callback, registering the device, and persisting credentials. The description does mention that one-time auth setup is required, but that is only a supporting prerequisite, not the main declared purpose. Therefore, this code chunk's primary behavior is materially narrower and different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands, accesses local files, and performs network operations, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates an overbroad execution surface where the agent may run with more capability than users or the platform can clearly audit, which is especially risky because the skill also handles authentication material and can initiate purchases.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Setup (one-time)

Auth stored at ~/.config/audible/auth.json (chmod 600).

Step 1 — generate login URL:

bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

- `audible` library is unofficial — Amazon may change their API without notice
- Auth tokens auto-refresh via device private key; re-auth only needed if device is deregistered
- Auth file is chmod 600 (owner-only read/write)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An authentication helper for Audible should not need to install software as part of normal operation, yet this script silently expands scope to package management. That mismatch makes the behavior risky in skill context because users expecting account setup may unknowingly permit network retrieval and installation of executable third-party code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs network package downloads and local installation after only a brief status message, without clearly warning the user that new executable code will be fetched and installed. In a security-sensitive auth flow, this lack of explicit consent and transparency materially increases risk from accidental execution, environment tampering, or package supply-chain compromise.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/audible_auth.py (reported line 27)May include surrounding context.

python

missing = []
    for pkg in ["audible", "httpx"]:
        try:
            __import__(pkg)
        except ImportError:
            missing.append(pkg)
    if missing:

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/audible_cli.py (reported line 32)May include surrounding context.

python

missing = []
    for pkg in ["audible", "httpx"]:
        try:
            __import__(pkg)
        except ImportError:
            missing.append(pkg)
    if missing:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script automatically invokes pip to install packages at runtime, which executes a subprocess and downloads code from external package sources without explicit informed consent. This expands the skill's behavior from Audible authentication into software installation, increasing supply-chain risk and enabling unexpected code execution if package sources, indexes, or the environment are compromised.

Content

Scanner excerpt · scripts/audible_auth.py (reported line 33)May include surrounding context.

python

if missing:
        print(f"Installing missing dependencies: {', '.join(missing)}...")
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet"] + missing
            )
            print("Dependencies installed.\n")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script saves Audible authentication material to disk with encryption explicitly disabled, and the user is not warned beforehand that sensitive credentials will be stored locally. Even with file mode 0600, plaintext credential storage increases the risk of credential theft from local compromise, backups, malware, or multi-process access on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Auto-installing Python packages during normal CLI execution expands the skill's behavior from Audible management into software installation, which introduces unnecessary remote code execution and supply-chain exposure. In the context of an authenticated account-management skill, this is more dangerous because users may trust and run it locally with access to sensitive auth files and personal account data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script automatically invokes pip at runtime to install packages, which causes code from external package repositories to be fetched and executed in the user's environment. Even though the package names are hardcoded, this creates a supply-chain and arbitrary code execution risk that is unrelated to the core Audible-management function and is especially risky for an agent skill that may run with the user's privileges.

Content

Scanner excerpt · scripts/audible_cli.py (reported line 38)May include surrounding context.

python

if missing:
        print(f"Installing missing dependencies: {', '.join(missing)}...")
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet"] + missing
            )
            print("Dependencies installed.\n")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The wishlist add path performs a remote state-changing action immediately, without a confirmation flag or even a cautionary prompt. In an agent setting, ambiguous user phrasing or prompt-manipulation elsewhere in the system could trigger unintended account modifications, making this more dangerous than a purely local CLI side effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

load_auth() reads ~/.config/audible/auth.json and constructs an authenticator from it, which implies access to stored authentication credentials. While the file path is shown in error/status output, there is no clear upfront disclosure in the command description or surrounding comments that running this CLI uses stored account auth data for remote API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.