ClawHub
Back to skill

Security audit

Epub Reader Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed EPUB formatting tool with local file-editing helpers and no evidence of hidden exfiltration, persistence, or automatic privileged behavior.

Reasonable to install for EPUB cleanup. Before running it, keep a backup of the original book, confirm the exact input and output paths, and approve remote font or repository fetching only when you trust the source and need that feature.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill expands its accepted inputs to Markdown, TXT, JSON, direct LLM context, and URLs/repositories, which materially broadens the attack surface beyond local EPUB styling. This can cause the agent to ingest unrelated or untrusted content, increasing risks of prompt injection, accidental processing of sensitive conversation context, and unauthorized scope creep.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
Allowing URL or repository fetching introduces network-originated untrusted input into a skill that is primarily presented as a local EPUB optimizer. Even with text claiming approval is required, this creates additional exposure to malicious content, repository-based prompt injection, and data exfiltration opportunities if network access controls are not enforced externally.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The document states that all side effects require explicit user consent, but the workflow then proceeds as if unpacking, rewriting, repackaging, and placing files are standard actions without a distinct consent gate. This mismatch can lead agents to perform file-modifying operations implicitly, undermining user expectations and increasing the chance of unauthorized changes to user data.

Static analysis

No suspicious patterns detected.