Reader Deep Dive

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:22 AM UTC
• Version: 0.1.0

Overview

This skill does what it says: it reads Readwise data, uses an LLM to create a briefing, and sends it by WhatsApp, but that workflow is privacy-sensitive.

Install only if you are comfortable with your Readwise reading history and generated summaries being processed by the configured Gemini CLI and sent through WhatsApp. Verify TARGET_NUMBER before running or scheduling it, store READWISE_TOKEN as a secret, and avoid enabling the cron job unless you want automatic recurring delivery.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises shell execution via its usage instructions but does not declare corresponding permissions or capabilities in a way that makes the operational scope explicit. This can lead users or orchestration systems to run code with broader effects than the manifest suggests, reducing transparency and informed consent around execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The described purpose understates important behaviors: outbound WhatsApp messaging, use of external credentials, and LLM-based analysis of user reading history. That mismatch is dangerous because users may authorize the skill expecting a local archive briefing, while it actually transmits personal reading-derived content to third parties and external destinations.

Description-Behavior Mismatch

Low

• Confidence: 79% confidence
• Finding: The documentation states that the skill sends a WhatsApp message, but that outbound communication is not clearly reflected in the top-level manifest description. Even if intended functionality, undocumented message delivery increases the risk of unexpected data disclosure or surprise exfiltration of reading summaries to an external messaging channel.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to export a Readwise access token but does not identify it as a sensitive credential tied to private reading history. This increases the chance users will expose the token through shell history, screenshots, shared terminals, logs, or accidental commits, enabling unauthorized access to personal data.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The setup instructions tell users to export a sensitive API token but provide no warning about secure storage, shell history exposure, or secret-management best practices. This increases the chance of accidental credential leakage through copied commands, shared terminals, dotfiles, or logs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends Readwise-derived reading titles to an external LLM (`gemini`) to infer a topic without any disclosure, minimization, or consent gate. Reading titles can reveal sensitive interests, work topics, health concerns, or political/religious preferences, making this an unnecessary third-party data exposure risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script sends detailed reading-history context—including summaries, URLs, authors, timestamps, and titles—to an external LLM for briefing generation. This substantially increases privacy risk because it can expose a rich profile of the user's interests, research, habits, and potentially confidential material from saved documents.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The generated briefing is transmitted to WhatsApp without an explicit warning that the content will leave the local environment and be delivered through an external messaging service. Because the briefing is derived from personal reading history, this creates an additional disclosure channel that may surprise users or send sensitive summaries to the wrong destination if misconfigured.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.