book-to-learn

• Outcome: Review
• Latest audit: Aug 23, 2026 · 5:39 PM UTC
• Version: 1.4.1

Overview

The skill’s purpose is legitimate, but it needs review because it can download links from book data and send generated or downloaded files to external services with limited safeguards.

Install only if you are comfortable with book text, generated cards, images, and selected attachments leaving your machine for IMA, Feishu, configured webhooks, and in Feishu webhook mode Catbox. Use it with non-sensitive books first, review items.json relatedLinks and image fields before scheduling, avoid Feishu webhook image mode for private content, and prefer explicitly configured paths/credentials with least-privilege service accounts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for attempt in range(3):
                # NOTE: no --insecure (TLS is verified); original PDFs may still
                # fail on self-signed hosts, which will be reported in `failed`.
                r = subprocess.run(['curl','-sL','--fail','--max-time','30','-A',UA,'-o',out,u], capture_output=True)
                if r.returncode == 0 and os.path.exists(out) and os.path.getsize(out) > 500:
                    head = open(out,'rb').read(8)
                    if head[:4]==b'\x89PNG' or head[:3]==b'\xff\xd8\xff' or head[:4]==b'GIF8' or head[:4]==b'RIFF':

• Confidence: 92% confidence
• Finding: The code fetches attacker-controlled URLs from items.json using curl without validating scheme, host, or destination class. In this skill, book content and generated items may originate from untrusted sources, so this creates an SSRF-style network primitive and can reach internal services or unexpected endpoints during setup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands, reads and writes local files, accesses environment variables, and performs network operations, yet it declares no explicit permissions or trust boundaries. This increases the chance that a host agent or user will authorize execution without understanding the full access scope, enabling unintended data exposure or command execution against local and remote resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose suggests book decomposition and card pushing, but the instructions also include broader behaviors: installing packages, downloading and processing attachments, uploading files to IMA, sending via Feishu API, posting to arbitrary webhooks, and uploading images to a third-party host. This mismatch is dangerous because users may consent to a narrow content-processing task while the skill actually exfiltrates data to multiple external services and performs broader system-side actions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill manifest focuses on book decomposition and daily card pushing, but this command adds general-purpose network retrieval of remote images from data controlled by items.json. Because the fetched URLs are not constrained, the feature broadens the trust boundary and enables unreviewed outbound requests that may contact attacker infrastructure or internal network targets.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The generated prompt instructs the agent to process attachments from relatedLinks and upload them, expanding the skill beyond the declared behavior. If relatedLinks come from untrusted book-derived data, this can cause the agent to retrieve and propagate arbitrary files, increasing exfiltration and malware-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The PDF generator embeds an attacker-controlled image src directly into HTML passed to WeasyPrint. If the image value is an arbitrary remote URL, the renderer may perform outbound network requests during PDF generation, enabling SSRF-like behavior, internal service probing, metadata endpoint access, or unexpected resource consumption outside the intended formatting task. In this skill context, content comes from books and generated payloads, so untrusted or transformed input reaching image increases risk rather than reducing it.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script embeds `payload['image']` directly into an HTML `<img src=...>` and then renders that HTML with WeasyPrint, which can cause local or remote resource fetching during rendering. If untrusted payload data is accepted, this expands the attack surface to SSRF-like outbound requests, unintended access to internal services, or retrieval of local files depending on renderer behavior and environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The --book value is joined directly into BOOKS_DIR without validation or canonicalization, so a slug like '../otherdir' can make the script read and write JSON and lock files outside the intended books/<slug>/ directory. Because this tool performs both reads and writes (including progress.json and .push_lock), an attacker who can control the book argument could tamper with arbitrary accessible files or cause unintended data disclosure from neighboring directories.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script explicitly states that Feishu card images are uploaded to catbox.moe, an unrelated third-party public host, before being embedded in messages. That creates an unnecessary data exfiltration path for user-provided or generated book content/images and can expose copyrighted, sensitive, or private material outside Feishu without clear consent or controls.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The upload_to_catbox function sends raw image bytes to an anonymous public image-hosting service with no registration or trust boundary aligned to the skill's purpose. Because the skill processes book-derived learning cards, these images may contain copyrighted content, personal annotations, or sensitive material that becomes available to an external service outside the user's expected messaging workflow.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script probes multiple assistant-specific directories in the user's home folder and automatically reads long-lived IMA credentials from ~/.config/ima. That expands the skill's trust boundary beyond the stated book-learning task and gives the skill access to sensitive local secrets and agent installations, increasing the blast radius if the skill is misused or modified.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This code uploads user-supplied files and metadata to an external IMA knowledge base service, which is a data exfiltration-capable behavior. In a skill context, outbound transfer of local documents is sensitive and should be explicitly disclosed and gated by user consent, especially because uploaded books or notes may contain proprietary or personal information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly documents downloading related attachments and, in the Feishu mode, uploading images to a third-party hosting service, but it does not clearly require user consent or warn that book content, attachments, or derived media may leave the local environment. This creates a real privacy and data-handling risk, especially if users process copyrighted, internal, or sensitive documents and assume all processing stays local.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code uploads images to catbox.moe silently and only reports upload failure after the fact; it does not provide any user-facing warning that content will leave the Feishu environment. This undermines informed consent and may lead users to disclose data they would not otherwise share with a public third party.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The script can upload local files, images, and message payload contents to Feishu immediately once invoked, without any explicit confirmation, dry-run mode, or consent guard in code. In an agent-skill context, this increases the chance of accidental exfiltration of sensitive local documents or generated content to an external SaaS destination.

Unvalidated Output Injection

High

• Category: Output Handling

Content

cmd += ["-e", referer]
    cmd += [url, "-o", out_path]
    try:
        subprocess.run(cmd, capture_output=True, timeout=90)
    except subprocess.TimeoutExpired:
        return False
    if not os.path.exists(out_path):

• Confidence: 83% confidence
• Finding: The script downloads arbitrary href values from payload.relatedLinks with curl and does not validate the destination host, scheme, or IP range. If an attacker can influence the payload, this can be abused as SSRF to reach internal services, cloud metadata endpoints, or other network-restricted resources, and the downloaded content is then written to disk for later processing.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: book_setup.py:36