Cookbook Forge

• Outcome: Review
• Latest audit: Jul 18, 2026 · 2:14 AM UTC
• Version: 1.2.0

Overview

This is a coherent book-generation skill, but review is warranted because some helpers can send diagram content to a third-party renderer and one generated diagram-rendering command is unsafe with untrusted filenames.

Before installing or using this skill on private materials, confirm whether diagrams may be sent to kroki.io or switch to a local renderer, avoid running the PlantUML helper on untrusted filenames, audit and update the generated Nextra dependencies before deploying, and treat generated prompt/conversion files as copies of the source content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script writes a Python file and executes it via execSync using a shell command string. Even though the generated script content is mostly internal, this grants host command-execution capability to a content-generation workflow and relies on shell/interpreter availability, increasing the blast radius if surrounding paths, environment, or future inputs become attacker-influenced. In a skill that processes untrusted user materials, unnecessary subprocess execution is a meaningful security risk.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Defaulting to Chinese output without clear user opt-in can cause unintended data handling and content-generation behavior, especially in multilingual or policy-constrained environments. It may also lead to incorrect disclosures, inaccessible deliverables, or downstream operational errors if users expect English or locale-neutral output by default.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Mandating Chinese comments in all generated code regardless of user preference can introduce compliance, maintainability, and review risks in teams that require English-only or locale-specific standards. In security-sensitive environments, forced nonrequested language output can reduce code auditability and increase the chance that important warnings or logic are misunderstood.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function unconditionally writes a `mimetype` file into the caller-supplied source directory before packaging. This is a real integrity and availability issue because invoking the API mutates input data in place, potentially overwriting an existing file, clobbering user content, or altering a checked-out repository/build tree without explicit consent. In this skill context, the tool processes user-provided document trees, so unexpected source mutation is more dangerous because inputs may come from local workspaces or generated artifacts that users expect to remain unchanged.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This script sends the full PlantUML diagram source to the third-party service kroki.io for rendering, which can disclose proprietary, internal, or sensitive architecture details embedded in diagrams. In the context of a documentation/book-generation skill that may process user-supplied repos, PDFs, and technical materials, users may reasonably expect local processing and may not realize their content is being transmitted externally.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script embeds full MDX chapter contents into prompt files explicitly intended for a downstream LLM agent to read and process. In this skill context, source materials may include proprietary documentation, unpublished manuscripts, credentials accidentally present in docs, or other sensitive content, so silently staging them for agent access and possible external model transmission creates a real data exposure risk.

Known Vulnerable Dependency: next==14.2.15 — 10 advisory(ies): CVE-2026-44573 (Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n); CVE-2026-44572 (Next.js's Middleware / Proxy redirects can be cache-poisoned); CVE-2025-48068 (Information exposure in Next.js dev server due to lack of origin verification) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: This project explicitly depends on Next.js 14.2.15, which the finding identifies as having multiple known advisories, including middleware/proxy bypass and cache-poisoning issues. In the context of a template that generates and serves documentation websites, shipping a known-vulnerable framework can expose deployed sites to request handling bypasses, information disclosure, or other framework-level attacks depending on enabled features and deployment mode.

Tool Parameter Abuse

Low

• Category: Tool Misuse

Content

try {
    for (const fmt of ["svg", "png"]) {
      const cmd =
        `docker run --rm -v "${srcDir}:/data" -v "${outDir}:/out" ` +
        `plantuml/plantuml:latest -charset UTF-8 -output /out -t${fmt} /data/${file}`;
      execSync(cmd, { stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
    }

• Confidence: 95% confidence
• Finding: The command string passed to `execSync` embeds `file` directly into a shell command without shell-safe escaping. Because `file` comes from directory contents, a crafted `.puml` filename containing shell metacharacters or command substitution could trigger arbitrary command execution on the host when the build helper runs.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/nextra-template/scripts/render-plantuml.mjs:22

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lbuild-epub.mjs:456

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: assets/nextra-template/docker-compose.yml:17