Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是 EPUB 内容样式与阅读体验优化类功能，而代码仅负责把目录封装成合规 EPUB 文件，核心目标是构建/打包而非美化或修复排版显示。两者主目的明显不同。代码没有处理 CSS、HTML、字体、颜色、代码块、表格或双语段落排版，因此与声明存在实质性不匹配。
- Content
Security audit
Epub Reader Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed local EPUB formatting and repackaging helper, with limited file-writing side effects that are mostly expected for its purpose.
Install only if you want an agent to edit EPUB working files. Use a copy of the original EPUB, confirm any remote font downloads yourself, and choose output paths carefully because helper scripts can overwrite an existing output file and remove source TTF files from the EPUB working directory after subsetting.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill clearly performs filesystem reads and writes on EPUB archives and extracted content, but it does not declare an explicit tool scope or permissions boundary. In agent environments, missing scope declarations can cause the runtime to grant broader file access than intended, increasing the chance of unauthorized modification or data exposure if the skill is invoked on the wrong paths.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description states the skill will '统一中英文双语段落排版' and optimize specifically for Chinese reading, which can imply a default language/locale preference. Because this is in the top-level invocation description, it may steer activation and behavior toward a Chinese-first presentation without first obtaining user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Line L011 states the core approach is to avoid changing chapter structure, HTML text, and image resources, limiting changes to CSS and necessary metadata. Later sections instruct rewriting XHTML with regex-based transformations such as wrapping formula images in span elements, adding class attributes to img/p/pre tags, and inserting formula-block containers, which directly contradicts that statement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill claims to be for EPUB optimization but accepts URLs, repositories, direct LLM context, and generic text/JSON inputs. Broad input modes expand the attack surface: remote fetches can introduce untrusted content, and non-EPUB ingestion increases the chance that the agent processes data it was not designed to safely sanitize or constrain.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description states the skill is for improving Chinese reading experience and unifying Chinese-English bilingual layout, which imposes a specific language/locale preference in the activation description. Although the document later supports bilingual strategies, the top-level description does not present locale choice or opt-in and frames the skill around Chinese-specific defaults.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L009 明确声称只通过重写 CSS 与必要元数据优化，不改变 HTML 文本与图片资源。但 L068-L072、L182-L199、L283-L315 等又指导对 XHTML 中的 img、p、pre 结构进行自动包裹、加类和替换，这与前述‘不改变 HTML 文本’形成直接意图冲突。
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring, usage instructions, and runtime messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. Under the policy, forcing a specific language is a natural-language policy violation unless the locale restriction is explicitly justified or optional.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code performs an irreversible file deletion with
src.unlink()after generating WOFF2 output. Although the top-level docstring describes the output files, it does not warn that the original TTF files will be removed, and there is no confirmation prompt before deletion.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file header and font selections explicitly target Chinese-language EPUB typography, and multiple class names are Chinese-specific. Under the policy rule, forcing a specific language/locale without user opt-in can be a violation unless the constraint is clearly documented and justified; this file does not provide such justification beyond implementation notes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This CSS file includes natural-language comments saying it is suitable for bilingual Chinese/English or Chinese translation EPUBs and describes styling choices specifically around those languages. Under the policy rule, forcing or assuming a specific language/locale without explicit user opt-in can be a violation when no alternative or choice is offered.
- Content