ZLibrary2Kindle

Search Z-Library for books, download them, and send to your Kindle.

Security Scan

The skill's runtime instructions require sensitive credentials and write/read user files (cookies, downloads) but the registry metadata declares no required environment variables or config paths — this mismatch and the need for SMTP/App passwords are disproportionate and unexplained.

Purpose & Capability

The skill claims to search Z-Library and email files to Kindle, which plausibly requires a Z-Library login and SMTP credentials; however the registry metadata lists no required environment variables or primary credential. The SKILL.md requires ZLIBRARY_EMAIL, ZLIBRARY_PASSWORD, SENDER_EMAIL, SENDER_PASSWORD and optional SMTP settings — those are not declared in the skill's manifest, indicating an incoherence between declared requirements and actual needed capabilities.

Instruction Scope

The instructions tell the agent to authenticate to ZLibrary (saving session cookies to ~/.cache/zlibrary2kindle/session.json), download files to /tmp/zlibrary2kindle/downloads/, and send email via SMTP. These actions involve reading/writing user home config and persistent cookies and handling sensitive credentials. The manifest did not surface these file paths or credential uses. The SKILL.md also instructs setting environment variables with plaintext passwords (Gmail App Password), which broadens the runtime data surface.

Install Mechanism

This is an instruction-only skill with no install spec or code files; that minimizes installation risk because nothing is fetched or written by an installer. The guidance references installing a pip package as an option, but no install behavior is included in the registry entry itself.

Credentials

The skill requires multiple sensitive secrets (ZLibrary credentials and an SMTP sender email and app password). While SMTP credentials are technically necessary to email a file to Kindle, the registry entry declares none of these as required env vars, and no primary credential is identified. Asking users to place long-lived credentials (especially Gmail app passwords) in environment variables is a sensitive practice that should be explicit in the manifest and justified.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does write session cookies to ~/.cache and downloads to /tmp, which are moderate local persistence actions but reasonable for a CLI that needs login caching. The manifest should nevertheless declare those config paths so users know what will be written to their home directory.

What to consider before installing

The SKILL.md and the registry entry do not match: the instructions clearly require a Z-Library account and SMTP credentials (including a Gmail App Password) and write session cookies to ~/.cache and downloads to /tmp, but the registry lists no required env vars or config paths. Before installing: 1) Do not paste your primary Gmail password or other primary-account secrets into environment variables for an untrusted skill — use an app-specific or throwaway account. 2) Ask the publisher for an explicit manifest that declares required env vars and config paths, and for a source or homepage so you can review code. 3) Consider running the CLI in a sandbox or isolated account to limit cookie and download exposure. 4) Be aware of legal/ethical issues: Z-Library is a site that distributes copyrighted works; confirm you are allowed to download the books. If the publisher cannot explain why these credentials are required and show a trustworthy source, avoid installing or using this skill.

Search Z-Library for books, download (EPUB preferred), and send to your Kindle via email.

Prerequisites

1. ZLibrary account — email and password
2. Kindle email whitelisted — Add sender in Amazon account settings
3. Gmail App Password — Required for Gmail SMTP with 2FA

Setup

# Simplest — no install needed
uvx zlibrary2kindle --help

# Or install locally
pip install zlibrary2kindle
z2k --help

# Set environment variables
export ZLIBRARY_EMAIL="[e-mail]"
export ZLIBRARY_PASSWORD="your-password"
export KINDLE_EMAIL="[e-mail]"
export SENDER_EMAIL="[e-mail]"
export SENDER_PASSWORD="xxxx xxxx xxxx xxxx"  # Gmail App Password

Tools

zlibrary_login

Authenticate to ZLibrary. Session cookies are saved to ~/.cache/zlibrary2kindle/session.json and reused automatically.

uvx zlibrary2kindle login
# or after install: z2k login

zlibrary_search

Search for books by title, author, ISBN, etc.

uvx zlibrary2kindle search "Python programming"
# or after install: z2k search "随园食单" --limit 5

Returns: list of books with book_id for use in download.

zlibrary_download

Download a book by its book_id (from search results).

uvx zlibrary2kindle download w8n2rz2N8Q
# or after install: z2k download <book_id>

Files saved to /tmp/zlibrary2kindle/downloads/.

kindle_send_email

Send a downloaded book to your Kindle.

uvx zlibrary2kindle send /path/to/book.epub "Book Title"
# or after install: z2k send /path/to/book.epub "Book Title" --to [e-mail]

File is deleted after sending.

Quick workflow

# 1. Login (once)
uvx zlibrary2kindle login

# 2. Search
uvx zlibrary2kindle search "随园食单"
# → [z9lRkJxQ8y] 随园食单 | [清]袁枚

# 3. Download
uvx zlibrary2kindle download z9lRkJxQ8y

# 4. Send to Kindle
uvx zlibrary2kindle send /tmp/zlibrary2kindle/downloads/随园食单.epub "随园食单"

MCP Mode

When Claude Code has this project's MCP server loaded, tools are available directly: zlibrary_login, zlibrary_search, zlibrary_download, kindle_send_email.

Configuration

Variable	Description
ZLIBRARY_EMAIL	ZLibrary account email
ZLIBRARY_PASSWORD	ZLibrary account password
KINDLE_EMAIL	Target Kindle email address
SENDER_EMAIL	SMTP sender email
SENDER_PASSWORD	SMTP password or Gmail App Password
SMTP_HOST	SMTP server (default: smtp.gmail.com)
SMTP_PORT	SMTP port (default: 587)