Book to Skill Converter 书本即技能

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  1.0.0

Overview

This skill reads user-provided books and creates local skill files, which matches its stated purpose, with ordinary file-handling cautions.

Install if you want an agent to process books you provide and create local skill files. Only give it files you intend to read, choose the output folder deliberately, and review generated files before relying on or sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs reading user-supplied local files in multiple formats and invoking other skills/libraries to extract content, but it declares no permissions or safety boundaries for file access. This creates an authorization and transparency gap: an agent may read local files without clear user consent semantics or sandbox constraints, which can expose sensitive data if file selection or path handling is broader than intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs saving generated content to a local path but does not warn about filesystem modification, destination restrictions, overwrite behavior, or the need for explicit user approval. In an agent context, this can lead to unintended file creation or overwriting in sensitive locations, especially if the save path is user-influenced or inferred automatically.

VirusTotal

64/64 vendors flagged this skill as clean.