Security audit

Epub Studio

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward EPUB generator with ordinary file creation and library-use risks, not evidence of hidden or malicious behavior.

Install in a virtual environment, consider pinning ebooklib to a reviewed version, generate files only to paths you choose, and avoid converting untrusted Markdown or HTML unless you sanitize it first.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
" ``` 2. Use a requirements or lock file with cryptographic hashes, and install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Configure `pip` to use the expected authenticated package index rather than untrusted mirrors. 4. Review and pin transitive dependencies where applicable. 5. Run installation and EPUB generation in an isolated virtual environment or sandbox with minimal filesystem and network permissions. 6. Periodically update pinned versions only after reviewing release provenance, dependency changes, and known vulnerabilities. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:48
Finding: Unsanitized User Content Embedded in EPUB XHTML
Content: View full analysis
{title}{content}' self.book.add_item(chapter) self.chapters.append(chapter) return chapter ``` The Markdown-processing path passes input into the same vulnerable operation without escaping or sanitization: ```python def add_markdown_chapters(self, markdown_content): """Split markdown into chapters""" sections = markdown_content.split('\n# ') for i, section in enumerate(sections): if not section.strip(): continue lines = section.split('\n') title = lines[0].replace('#', '').strip() content = '
'.join(lines[1:]) self.add_chapter(title, content) ``` ### Technical Analysis Both `title` and `content` can originate from user-supplied input. They are interpolated directly into an XHTML document: ```python chapter.content = f'
{title}
{content}' ``` The title is not HTML-escaped, and the purported Markdown content is not processed by a Markdown parser. Joining input lines with `
` does not sanitize them; existing tags, attributes, external resources, or active content remain intact. An attacker can therefore terminate or alter the intended `
` element and inject arbitrary EPUB-compatible markup. Depending on the target reader's security model, injected content could modify displayed content, load external resources, create tracking requests, present deceptive links or forms, or attempt active-content execution. Reader support for scripts and dangerous URI schemes varies, so host code executi ...[truncated 1357 chars]
Remediation: View remediation
`, ``, `<object>`, and `<embed>` elements - Inline event handlers such as `onclick` and `onload` - Unsafe URI schemes such as `javascript:` - Unexpected remote resource references - Active SVG content and other reader-dependent executable formats 6. Validate generated XHTML before packaging the EPUB. 7. Add security tests using malicious titles and bodies to confirm that injected tags, event handlers, active URLs, and external resources are escaped or rejected. 8. Document whether intentional HTML input is supported. If it is required, process it through a restrictive sanitizer rather than embedding it verbatim. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The constructor sets language='zh' by default, which imposes a specific locale unless the caller explicitly overrides it. This is a natural-language locale policy concern because the skill does not indicate that users will be asked for their preferred language or that Chinese is only a default example for a region-specific tool.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.
text
permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The code writes an EPUB file to a user-specified path via epub.write_epub(output_path, self.book, {}), which modifies the filesystem. Although there is a docstring saying 'Save EPUB file', there is no user-facing warning in the skill description or usage notes that running the skill will create or overwrite a local file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.