clawdible -audiobooks

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:27 PM UTC
• Version: 1.0.1

Overview

This Audible account helper is disclosed and purpose-aligned, but users should treat its dependency installs and stored Audible auth file carefully.

Install only if you are comfortable giving this skill access to your Audible account. Prefer running it in a virtual environment with reviewed versions of audible and httpx already installed, protect ~/.config/audible/auth.json like a password, and verify the exact title, ASIN, narrator, marketplace, and cost before confirming any purchase.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if missing:
        print(f"Installing missing dependencies: {', '.join(missing)}...")
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet"] + missing
            )
            print("Dependencies installed.\n")

• Confidence: 94% confidence
• Finding: This script automatically invokes pip to install packages at runtime, which expands the trust boundary from the local script to the Python package index and the executing environment. In an auth helper that handles authentication state and credentials, implicit package installation is risky because it can execute unreviewed dependency code, produce non-reproducible behavior, and expose users to dependency confusion or compromised package supply-chain events.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if missing:
        print(f"Installing missing dependencies: {', '.join(missing)}...")
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "--quiet"] + missing
            )
            print("Dependencies installed.\n")

• Confidence: 92% confidence
• Finding: This code invokes pip at runtime to install packages automatically, which executes a network-dependent package supply-chain action during normal skill use. Even though the package names are hard-coded and shell injection is not present, auto-installing code at runtime can introduce unreviewed dependencies, enable dependency confusion or compromised-package scenarios, and violates least surprise for a book-management CLI.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes runtime behaviors that include shell execution, network access, and reading/writing local auth material, yet there is no declared permission boundary or user-visible capability declaration. In an agent ecosystem, this weakens transparency and policy enforcement, making it easier for a seemingly simple audiobook skill to perform sensitive actions such as pip installs, token storage, and purchases without clear prior authorization.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Auto-installing Python packages is unrelated to the core Audible authentication flow and introduces unnecessary code execution during a sensitive auth process. Because this script stores authentication material and guides users through login, adding runtime package installation increases the attack surface and makes the skill more dangerous than a normal utility script.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill performs automatic dependency installation on startup, which is unnecessary for its stated Audible-management purpose and creates a software supply-chain risk. In this context, the skill also handles authenticated account operations, so introducing unpinned packages at runtime increases the chance that a compromised dependency could access account tokens, library data, or purchase capabilities.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad enough to activate on common audiobook-related requests, including commercial actions like "buy audiobook" and account-scoped actions like viewing a library or wishlist. In context, this is more dangerous because the skill can authenticate to a user's Amazon/Audible account and perform state-changing operations, so over-broad invocation increases the chance of accidental or premature activation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The wishlist add path performs a state-changing API call immediately, without a confirmation flag or in-code user-consent gate comparable to the purchase flow. In an agent setting, this makes unintended account modifications more likely because ambiguous prompts, prompt injection, or tool misuse could silently alter a user's Audible wishlist.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.