T08 · Insecure Dependencies
Warning
- Location
skill.md:18- Finding
Unpinned and Unaudited Third-Party Package Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
ZLibrary2Kindle
Security checks for vulnerabilities and agentic risk
Overview
The skill's book-download and Kindle-email workflow is mostly coherent, but it runs unpinned third-party code with service and email credentials, so users should review it carefully before installing.
Review and constrain this before installing. Use a pinned and verified `zlibrary2kindle` version, avoid exporting long-lived credentials into a broad shell environment, prefer revocable app-specific passwords, check where session cookies are stored, and confirm you are comfortable with downloaded files being emailed and then deleted locally.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
name: zlib2k-cli description: Search Z-Library for books, download them, and send to your Kindle. allowed-tools: Bash(uvx:) Bash(pip:) Bash(python:*)
ZLibrary2Kindle
Search Z-Library for books, download (EPUB preferred), and send to your Kindle via email.
Prerequisites
- ZLibrary account — email and password
- Kindle email whitelisted — Add sender in Amazon account settings
- Gmail App Password — Required for Gmail SMTP with 2FA
Setup
bash # Simplest — no install needed uvx zlibrary2kindle --help # Or install locally pip install zlibrary2kindle z2k --help # Set
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes login, credential export, session-cookie storage, remote downloads, email sending, and post-send file deletion, but it does not explicitly warn users about privacy, credential-handling, filesystem, and network risks. In this context, users may paste long-lived secrets and run commands that affect local files and external accounts without informed consent or safety expectations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill repeatedly instructs users to run
uvx zlibrary2kindlewithout pinning a specific package version. Becauseuvxresolves the latest available package by default, a future malicious or compromised release could be fetched and executed with the user's credentials and network access, creating a supply-chain execution risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
This command invokes
uvx zlibrary2kindlewithout version pinning, so the tool executed may change over time. If the upstream package is compromised, the user's Z-Library and SMTP credentials, downloaded files, or local environment could be exposed through automatic execution of unreviewed code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The search example uses an unpinned
uvxpackage reference, which means users may execute different code than the skill author originally tested. In this skill's context, that code has access to network operations and may handle authentication state, making package drift more dangerous than a simple offline utility.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The download workflow depends on executing the latest resolved
zlibrary2kindlepackage, which creates a supply-chain risk. Because the command downloads external content and writes files locally, a compromised upstream version could misuse filesystem and network privileges.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The send-to-Kindle example uses an unpinned package that can access SMTP credentials and transmit files by email. Running mutable upstream code in a credentialed email-sending workflow materially increases the impact of a package compromise.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The quick workflow again asks users to execute
uvx zlibrary2kindlewithout pinning, preserving the same supply-chain risk across the primary happy path. Since this is the most likely path users will copy and paste, it increases exposure to arbitrary code execution from a compromised future release.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
This search step in the quick workflow executes an unpinned package from the registry. In context, users are likely to run it after configuring credentials, so a compromised package could immediately access secrets and session data.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The quick workflow's download command relies on unpinned remote package execution, which is a real supply-chain vulnerability pattern. The tool's ability to fetch content and save files locally makes compromise potentially impactful beyond simple command output manipulation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The send step executes an unpinned package in a context where it can read local files and use SMTP credentials. That combination means a malicious upstream release could exfiltrate documents, steal credentials, or send unauthorized emails.
- Content