Reader Deep Dive

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:08 AM UTC
• Version: 0.1.0

Overview

The skill behaves like a disclosed Readwise-to-Gemini-to-WhatsApp briefing tool, with privacy and prompt-injection caveats users should understand.

Install only if you are comfortable sharing Readwise reading metadata with Gemini and receiving the generated summary over WhatsApp. Set TARGET_NUMBER deliberately, try a manual run before adding the cron schedule, and be aware that malicious or misleading article metadata could influence the generated briefing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/brief.sh:34

Finding

Untrusted Readwise Metadata Can Inject Instructions into LLM Prompts

Content

View full analysis

/dev/null | tail -n 1 | tr -d '\n') ``` ```bash CONTEXT_DATA="TOPIC: $QUERY RECENT_SAVES (Last 24h): $(echo "$RECENT_JSON" | jq -r '.results[] | "Title: \(.title)\nAuthor: \(.author)\nType: \(.category)\nSaved: \(.saved_at)\nSummary: \(.summary)\n"') ARCHIVE_HITS (Historical context): $(echo "$ARCHIVE_JSON" | jq -r '.results[] | "Title: \(.title)\nAuthor: \(.author)\nType: \(.category)\nSaved: \(.saved_at)\nSummary: \(.summary)\nURL: \(.url)\n"') GOAL: Provide at least 5 deep dive connections from the archive, ordered by save date." # Capture multi-line response # We find where the actual content starts (skipping initialization logs) BRIEF=$(gemini -o text 2>/dev/null <

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The stated purpose sounds like a local reading-summary workflow, but the documentation indicates additional behaviors: outbound WhatsApp delivery, external LLM processing of reading-derived content, and Readwise data access. This mismatch is dangerous because users may authorize or run the skill without understanding that personal reading history is being transmitted to third parties.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md

## Setup

1.  Get your Access Token from [readwise.io/access_token](https://readwise.io/access_token).
2.  Set it in your environment:
    ```bash
    export READWISE_TOKEN="your_token_here"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

## Setup

1.  Get your Access Token from [readwise.io/access_token](https://readwise.io/access_token).
2.  Set it in your environment:
    ```bash
    export READWISE_TOKEN="your_token_here"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script sends detailed recent and historical reading data—including titles, authors, summaries, save dates, and URLs—to Gemini to generate the briefing. This is a substantial privacy exposure because it transmits rich user-derived reading history to an external model provider without an explicit warning or consent mechanism.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly describes scanning a user's recent saves, mining their full reading archive, and delivering synthesized results over WhatsApp, but it provides no privacy notice, consent language, data handling boundaries, or warning that third-party services may receive personal reading-history data. In this context, the omission is security-relevant because reading history can be sensitive behavioral data, and WhatsApp/LLM delivery expands exposure beyond the original source platform.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares shell execution capability via its documented usage (bash scripts/brief.sh, cron command) but does not declare any tool scope or permissions. This weakens security boundaries and informed consent because the skill can execute local commands and access environment-provided secrets without an explicit manifest-level declaration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation claims the skill sends a WhatsApp briefing, but the manifest only declares a Readwise token requirement and no messaging capability. That undocumented outbound channel creates a risk of hidden data exfiltration or use of an unexpected integration, especially because reading-derived summaries may contain sensitive personal interests or research topics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill omits a clear privacy warning that it sends content derived from the user's reading history over WhatsApp. In this context, that is risky because reading activity can reveal sensitive interests, work topics, health concerns, or political views, and users are not clearly warned before data leaves the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends article titles derived from the user’s Readwise data to Gemini for topic analysis without any visible disclosure or consent flow. Even titles alone can reveal sensitive interests, projects, health topics, or other private reading behavior, creating an avoidable third-party data exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The script builds a prompt containing detailed recent and historical Readwise content, including titles, authors, summaries, timestamps, and URLs, then generates a briefing and sends that briefing to an external messaging target. While framed as a briefing workflow, the natural-language intent is to collect and retransmit user-associated reading data to another destination, which fits a semantic data-leak pattern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a 'Daily briefing' that semantically covers gathering reading data, analyzing it, and producing a briefing. However, the code also performs outbound delivery to an external phone number via clawdbot message send, which is a distinct messaging/distribution capability not disclosed by the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated briefing, which is based on the user’s reading history and archive content, is forwarded to WhatsApp without explicit disclosure that this derived content will be sent to another external service. This can leak sensitive inferences and summaries of private reading behavior to a messaging platform and to any party with access to the target account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.