ClawHub
Back to skill

Security audit

KDP Publisher DE

Security checks for vulnerabilities and agentic risk

Overview

This PDF-building skill mostly matches its stated purpose, but it can upload manuscript content and potentially unintended local include files to a remote service without tight safeguards.

Review this skill before installing if you handle private manuscripts or sensitive project files. Use it only on trusted input, avoid direct Typst files with untrusted #include directives, verify the TypeTex endpoint, and prefer a pinned virtual environment for dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/compile.py:151
Finding

Arbitrary Local File Disclosure Through Unrestricted Typst Include Paths

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Python Dependencies Create Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation
qrcode== ``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a dependency-locking tool such as `pip-tools`, Poetry, or an equivalent reproducible workflow to lock transitive packages. 4. Require installation in a dedicated virtual environment rather than a shared system environment: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 5. Review and update pinned versions through a controlled maintenance process that includes vulnerability scanning and release verification. 6. Document the expected package index and discourage installation from untrusted mirrors or user-controlled indexes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tainted flow: 'API_URL' from os.environ.get (line 87, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The endpoint is taken directly from the TYPETEX_API_URL environment variable and used for outbound network access without validation. In an agent or CI environment, an attacker who can influence environment variables can redirect health checks to attacker-controlled infrastructure, enabling SSRF-style egress, internal service probing, or trust decisions based on a forged health endpoint.

Content

Scanner excerpt · scripts/compile.py (reported line 94)May include surrounding context.

python
def health_check():
    try:
        r = requests.get(f"{API_URL}/public/compile/health", timeout=10)
        return r.json().get("status") == "ok"
    except Exception:
        return False

Tainted flow: 'API_URL' from os.environ.get (line 87, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
97% confidence
Finding

The script sends the full Typst source and auxiliary files to a remote endpoint derived from an unvalidated environment variable. If that variable is attacker-controlled, sensitive local document contents can be exfiltrated to arbitrary servers, and the skill context increases severity because included files are automatically collected and transmitted.

Content

Scanner excerpt · scripts/compile.py (reported line 108)May include surrounding context.

python
print(f"[KDP] Sende an TypeTex API...")
    start = time.time()
    try:
        r = requests.post(f"{API_URL}/public/compile/typst", json=payload, timeout=120)
        elapsed = round(time.time() - start, 1)
        if r.status_code != 200:
            return {"success": False, "error": f"HTTP {r.status_code}: {r.text[:300]}"}

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example trigger phrase "Kompiliere das komplette Buch als PDF" is broad and does not constrain which files, directories, or trust boundaries the skill may operate on. In an agentic environment, vague build requests can cause the skill to ingest unintended local content, process sensitive files, or act on a wider workspace than the user intended, especially if the implementation auto-discovers chapters or source material.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description includes broad invocation phrases like 'Bau mir ein PDF aus [Dateiname]' and 'Kompiliere Kapitel 3' without clear scoping or guardrails. This can cause accidental or overly broad triggering by an agent, increasing the chance that unintended files are processed or sensitive content is sent through the build pipeline.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill states that content is sent to the external TypeTex API to generate PDFs, but it does not present a clear user-facing warning that chapter or book contents will leave the local environment. This creates a real data exfiltration and privacy risk, especially if users compile unpublished manuscripts, proprietary material, or sensitive embedded data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Hard-coding the skill language to German without signaling user choice or opt-in can cause the skill to engage users in an unexpected language, increasing the risk of misunderstanding prompts, outputs, or permissions. While this is primarily a safety and usability issue rather than a direct exploit path, confusion can contribute to unintended actions in an agent setting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command trigger "Erstelle ein PDF" is very generic and can match many unrelated user requests, causing the skill to activate outside its intended KDP/Markdown-to-book workflow. Overbroad activation can route sensitive or irrelevant user content into this skill unexpectedly, especially since the manifest also declares network access, increasing the chance of unintended processing or external transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level documentation says the tool compiles Typst to PDF via the TypeTex API, which implies a network-backed compilation flow. However, when the API health check fails, the script imports subprocess and runs a local typst compile command instead, introducing a materially different execution model than the docstring describes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains natural-language instructions presented to users only in German, including the module description and usage text. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The script performs external transmission of main_content and auxiliary_files to a remote compilation service. In this skill context, that is particularly sensitive because the code automatically reads local include files and uploads them, which can expose proprietary or confidential manuscript contents if the remote service is untrusted or misconfigured.

Content

Scanner excerpt · scripts/compile.py (reported line 108)May include surrounding context.

python
print(f"[KDP] Sende an TypeTex API...")
    start = time.time()
    try:
        r = requests.post(f"{API_URL}/public/compile/typst", json=payload, timeout=120)
        elapsed = round(time.time() - start, 1)
        if r.status_code != 200:
            return {"success": False, "error": f"HTTP {r.status_code}: {r.text[:300]}"}

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compile.py (reported line 178)May include surrounding context.

python
print(f"[KDP] API nicht erreichbar — versuche lokales Typst...")
        import subprocess
        try:
            r = subprocess.run(["typst","compile",main_file,output_file],
                               capture_output=True, text=True, timeout=60)
            if r.returncode == 0:
                print(f"[KDP] ✓ Lokal: {output_file}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description specifies German invocation phrases and presents the skill usage entirely in German, which can amount to a locale/language constraint without explicit user opt-in. There is no statement that other languages are supported or that German is required for a justified regional reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The BOOK_HEADER sets language: "de", and the script’s user-facing usage/help text is also German-only. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language and configuration context indicate this skill is oriented to German output, and the language parameter is hard-coded to a default of "de". Under the policy, forcing a specific language or locale without user opt-in can be a language/locale policy violation when no explicit choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring presents the tool description and usage entirely in German, which imposes a specific language on users. Under the policy, locale or language constraints should be optional or clearly justified as region-specific; this file does not provide such justification or an opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI prints a German-only error message when the input file is missing. This is a natural-language policy issue because the skill enforces one locale in user-facing output without offering a language choice or stating that the tool is intentionally limited to German users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.