Turn Any Book into a Working Agent 一键把书变成员工

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:38 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent book-to-agent purpose, but it turns untrusted book text into persistent agent instructions and filesystem paths without enough safeguards.

Review this carefully before installing. Use it only with trusted books or in a sandbox, inspect every generated SKILL.md before adding it to a real skill library, replace book-derived directory names with safe slugs, and pin dependencies in a virtual environment. Do not let generated skills auto-install or auto-activate without human approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:62
• Finding: Untrusted book content is embedded into executable skill instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-78, 186-231` **Vulnerability Type**: Untrusted content injection into generated agent instructions **Risk Level**: High ### Vulnerable Code ```python def analyze_book(text): """分析书籍内容，提取关键信息""" # 提取书名（尝试从文件名或内容推断） book_title = extract_title(text) # 提取核心主题 themes = extract_themes(text) # 提取方法论/框架 methodologies = extract_methodologies(text) # 提取关键概念 concepts = extract_concepts(text) # 提取实践步骤 practices = extract_practices(text) # 定义员工角色 agent_role = { "name": f"{book_title}专家", "title": f"基于《{book_title}》的{themes[0] if themes else '专业'}顾问", "description": f"我是一位基于《{book_title}》训练的 AI 专家员工。我掌握了书中{len(methodologies)}个核心方法论和{len(concepts)}个关键概念，可以帮助你{practices[0] if practices else '解决相关问题'}。", "expertise": themes, "methodologies": methodologies, "key_concepts": concepts, "services": practices, "activation_phrase": f"请作为《{book_title}》专家帮助我...", "capabilities": generate_capabilities(methodologies, practices) } return agent_role ``` ```python def generate_skill_md(agent_def, output_path): """生成 Skill.md 文件""" md_content = f'''# {agent_def["name"]} ## 角色定位 {agent_def["title"]} ## 核心能力 {chr(10).join(f"- {cap}" for cap in agent_def["capabilities"])} ## 专业知识 基于《{agent_def["title"].split("的")[1].split("顾问")[0] if "的" in agent_def["title"] else "专业书籍"}》深度训练，掌握: ### 核心方法论 {chr(10).join(f"- {m}" for m in agent_def["methodologies"][:5])} ### 关键概念 {chr(10).join(f"- {c}" for c in agent_def["key_concepts"][:8])} ## 使用场景 当我需要: {chr(10).join(f"- {s}" for s in agent_def["services"])} ## 激活方式 对我说："{agent_def["activation_phrase"]}" ## 工作流程 1. **理解需求**: 分析用户的具体问题和背景 2. **调用知识**: 从书中提取相关的方法论和案例 3. **提供方案**: 给出结构化、可执行的建议 4. **跟进优化**: 根据反馈调整方案 ## 专业领域 {chr(10).join(f"- {e}" for e in agent_def["expertise"])} --- *此 AI 员工由 Book-to-Agent 技能自动生成* ''' with open(outp ...[truncated 2298 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place raw or lightly processed book content into an executable skill instruction file. 2. Keep trusted instructions in a fixed, reviewed template and store extracted knowledge in a separate data file treated explicitly as untrusted reference material. 3. Apply strict schemas to all generated fields: - Enforce short maximum lengths. - Permit only expected character classes. - Reject control characters and unexpected line breaks. - Reject Markdown headings, fenced code blocks, HTML, links, and instruction-like directives. 4. Escape Markdown metacharacters before rendering any untrusted value. 5. Use a structured serialization format for reference data rather than embedding it directly into instruction sections. 6. Add an explicit trusted instruction stating that book-derived content is evidence only and must never override system, developer, or skill-level rules. 7. Require human review and approval of the complete generated skill before installation. 8. Add adversarial tests using books containing headings, prompt-injection phrases, code blocks, and attempts to override previous instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:281
• Finding: Path traversal through an unvalidated book-derived agent name<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:281-283` **Vulnerability Type**: Untrusted filesystem path construction **Risk Level**: High ### Vulnerable Code ```bash AGENT_NAME=$(python -c "import json; print(json.load(open('agent_definition.json'))['name'])") mkdir -p "SKILLs/book-agents/${AGENT_NAME}" cp SKILL.md "SKILLs/book-agents/${AGENT_NAME}/SKILL.md" ``` The same unsafe construction is also documented earlier: ```bash AGENT_NAME=$(python -c "import json; print(json.load(open('agent_definition.json'))['name'])") mkdir -p "SKILLs/book-agents/${AGENT_NAME}" # 生成 SKILL.md python generate_skill_md.py agent_definition.json ``` ### Technical Analysis `AGENT_NAME` is read from `agent_definition.json`, and the agent name is originally derived from the untrusted book title. It is then used directly as a filesystem path component. Shell quoting protects against ordinary word splitting and some forms of shell expansion, but it does not neutralize path traversal sequences such as `../`. No allowlist, canonicalization, basename enforcement, or post-resolution containment check is performed. Consequently, a crafted agent name can cause the destination to resolve outside `SKILLs/book-agents`. The Windows batch implementation follows the same unsafe design by inserting `%AGENT_NAME%` directly into a destination path. ### Attack Path 1. An attacker supplies a book whose extracted title produces a malicious agent name containing path separators or traversal components. 2. `analyze_book.py` writes that name into `agent_definition.json`. 3. The shell script reads the value into `AGENT_NAME`. 4. `mkdir -p` resolves traversal components and creates a directory outside the intended skill root. 5. `cp` writes the generated `SKILL.md` to the attacker-selected resolved location. 6. If a security-sensitive or automatically loaded skill location is targeted, the written file may affect later agent behavior. ### Impact Assessment The script can create ...[truncated 530 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate the human-readable agent name from its filesystem identifier. 2. Generate a safe slug using an allowlist such as `[A-Za-z0-9._-]`. 3. Reject path separators, traversal components, absolute paths, control characters, and names equal to `.` or `..`. 4. Resolve the candidate destination to a canonical absolute path before creating it. 5. Verify that the resolved destination remains beneath the canonical `SKILLs/book-agents` root. 6. Abort rather than silently rewriting invalid names. 7. Refuse to overwrite an existing skill unless the user explicitly approves the exact canonical destination. 8. Apply equivalent validation and containment checks in the Windows implementation. 9. Prefer implementing path construction with a language-level path library, such as Python's `pathlib`, instead of assembling paths in shell scripts. A secure pattern should perform a containment check similar to: ```python from pathlib import Path import re root = Path("SKILLs/book-agents").resolve() name = agent_definition["name"] if not re.fullmatch(r"[A-Za-z0-9._-]{1,80}", name): raise ValueError("Unsafe agent name") destination = (root / name / "SKILL.md").resolve() if root not in destination.parents: raise ValueError("Destination escapes the skill root") ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:374
• Finding: Unpinned third-party dependency installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:374-375` **Vulnerability Type**: Unpinned and unverifiable package installation **Risk Level**: Medium ### Vulnerable Code ```text - pypdf (用于 PDF 提取): `pip install pypdf` - ebooklib (用于 EPUB): `pip install ebooklib` ``` ### Technical Analysis The installation instructions request packages by name without pinning reviewed versions or verifying package hashes. Package resolution therefore depends on the mutable state of the configured Python package index at installation time. This makes installations non-reproducible and exposes users to unexpected upstream changes, compromised releases, index misconfiguration, or an unsafe package source configured in the local environment. Installation is also not explicitly constrained to an isolated virtual environment. The audited file does not identify a currently malicious version of either package. The finding concerns the unsafe dependency acquisition procedure. ### Attack Path 1. A user follows the documented `pip install` commands. 2. `pip` consults the user's configured package indexes and resolves the current available versions. 3. The selected package or one of its transitive dependencies differs from the version originally reviewed or expected by the skill author. 4. Package-controlled build or installation behavior executes with the permissions of the user running `pip`. 5. A compromised or otherwise unsafe dependency can affect the Python environment and subsequent skill execution. ### Impact Assessment A malicious package or dependency may execute code during installation or when imported. Its privileges are those of the user or environment running `pip`. The potential scope includes the active Python environment and files or credentials accessible to that user. System-wide impact is possible if the installation is performed with administrative privileges, although the documentation does not explicitly request elevated installation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin reviewed dependency versions in a requirements or lock file. 2. Record and verify cryptographic hashes, for example with `pip install --require-hashes`. 3. Document installation inside a dedicated virtual environment. 4. Review and lock transitive dependencies rather than only top-level packages. 5. Use a trusted package index and disable unapproved supplemental indexes. 6. Add automated dependency vulnerability and integrity scanning. 7. Define an update process that reviews new versions before changing the lock file. 8. Avoid running package installation with administrative privileges. Example hardened installation workflow: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ae1

High

• Category: analysis-evasion

Content

output = sys.argv[2] if len(sys.argv) > 2 else 'SKILL.md'

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill description and generated prompts are written as if the skill operates in Chinese by default, and later generated activation phrases and outputs are also hard-coded in Chinese. There is no indication that users can opt into another language or that the locale restriction is required for a region-specific purpose.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation phrase is a natural-language template ('请作为《{book_title}》专家帮助我...') that is broad enough to overlap with ordinary conversation and can trigger unintentionally. In multi-skill environments, ambiguous invocation increases the chance of accidental activation of a generated expert persona, leading to unintended behavior or unsafe delegation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The documented activation method tells users to invoke the skill with a common conversational phrase, without any delimiter, namespace, or trigger constraints. That makes accidental invocation and cross-skill collisions more likely, especially because the generated agent names are based on arbitrary book-derived text.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The advertised example trigger is overly generic and encourages deployment with a phrase that could appear in normal user requests. This is risky because the skill generates new agents dynamically, so ambiguous examples normalize unsafe invocation patterns at scale.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The Windows example repeats the same broad natural-language activation guidance, reinforcing an unsafe invocation pattern across platforms. Repetition in examples increases the likelihood that users and downstream tool builders adopt ambiguous triggers unchanged.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states generated agents will not exceed the book's knowledge scope, but the implementation always adds generic capabilities such as '提供专业咨询和建议' and '制定行动计划' regardless of extracted source content. This creates a trust mismatch: users may rely on the generated agent as if it were strictly grounded in the uploaded book when it is actually granted broader advisory framing.

Static analysis

No suspicious patterns detected.