Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Openclaw
v2.0.1Intelligent book reading and analysis skill. When the user provides an EPUB or TXT book file, split it into chapters, perform deep analysis and summarization...
⭐ 0· 159·0 current·0 all-time
byBillWang@drbillwang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with required binary (python3) and the declared Python libraries (ebooklib, beautifulsoup4). Asking the agent to extract text, split into chapters, and save files is coherent for a book-analysis skill. However, core instructions that demand a 'high-fidelity condensed version' equivalent to reading the original and preservation of anecdotes/dialogue can push the agent toward reproducing large verbatim sections of the source; that is disproportionate for a 'summarization/analysis' purpose and raises copyright/legal concerns.
Instruction Scope
SKILL.md explicitly instructs creating and running a Python script (ebooklib + BeautifulSoup) and reading/writing many local files (input/, chapters/, summaries/) — this is within expected scope. Concerns: (1) the instructions actively encourage the output to mimic the original text's tone and preserve detailed anecdotes/dialogue, which can result in reproducing copyrighted material rather than summarizing; (2) the SKILL.md is truncated ('Phase Five: Output G …[truncated]') so some runtime expectations are missing, creating ambiguity and risk of unexpected behavior; (3) the instructions require discretion-heavy operations ('AI-driven decision making' and 'take the time needed'), which are vague and give broad agent autonomy over what to extract and how much to reproduce.
Install Mechanism
The registry lists this as an instruction-only skill (no install spec), but SKILL.md includes an 'install' section that lists pip packages (ebooklib, beautifulsoup4). Installing these PyPI packages is reasonable for EPUB parsing; both are common packages. The mismatch between the registry 'no install spec' and SKILL.md's install directives is an inconsistency to flag (it affects user expectations about whether packages will be installed automatically). No high-risk external download URLs are present.
Credentials
The skill requests no environment variables, no external credentials, and no privileged config paths — proportional to its purpose. It requires filesystem access to read the user-supplied file and write intermediate and output files, which is expected for a document-processing skill. There is no evidence the skill attempts to access unrelated secrets or remote endpoints.
Persistence & Privilege
always:false and user-invocable:true — normal for a skill. There are no instructions to modify other skills or global agent settings. The skill asks the agent to create local files and run python scripts under the agent, which is standard and limited in privilege.
What to consider before installing
Before installing, note three things: (1) copyright/legal risk — the instructions push the agent to produce 'high-fidelity' condensed versions that preserve anecdotes, tone, and dialogue. That behavior can reproduce large portions of a book and might violate copyright unless the user owns the rights or the work is public-domain. Prefer using this skill only with public-domain texts or ones you have rights to. (2) SKILL.md is truncated and there is a small metadata mismatch: the skill is listed as instruction-only in the registry but the SKILL.md requests pip installs (ebooklib, beautifulsoup4). If you allow the skill to run, be prepared for it to install Python packages and create/read/write files in the agent's working directories (input/, chapters/, summaries/). (3) If you need stricter behavior (e.g., summaries that avoid long verbatim excerpts), ask for explicit constraints up-front or decline to install. If you want higher confidence about exact behavior, request the missing/truncated portion of SKILL.md and a clear install/runtime plan from the publisher before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk977mmhwnpr6c06m5ahsp5t9w1837cg8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📖 Clawdis
Binspython3