T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/extract.js:40- Finding
Unrestricted Browser Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Castreader Openclaw Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it has broad network and local-library access with under-disclosed privacy and containment risks.
Review before installing. Use it only with URLs and book content you are comfortable sending to CastReader's API, avoid internal or localhost URLs, and do not run it in an environment with access to sensitive internal web services or broad private files. Prefer an isolated account/container and updated dependencies.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/sync-books.js:139- Finding
Unvalidated Book Identifier Allows Directory Traversal
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/read-url.js:113- Finding
Predictable Shared Temporary Paths Permit Cache Poisoning and Symlink Attacks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (37)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description centers on turning a URL/web page into spoken audio/MP3 and reading books aloud. The supplied code instead implements text extraction and highlighting infrastructure, especially for WeChat Reading and Kindle, plus several document platforms. It manipulates the DOM extensively, creates overlay elements for paragraph and word highlighting, performs OCR on Kindle screenshots/blob images, parses render/token data, and communicates with a browser extension runtime. While such extraction could be a supporting component of a read-aloud product, this chunk does not implement the declared core capability of TTS/audio generation or MP3 conversion. It also covers many undeclared sites and capabilities unrelated to a simple URL-to-audio skill. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on converting URLs/web pages/books into spoken audio and specifically promises AI speech and podcast-quality MP3 output. The supplied code chunk only implements content extraction from DOM pages: site-specific extractors, language detection, paragraph segmentation, shadow DOM handling, fanqie text decoding, and an extraction pipeline exposed as window.__castreaderExtract. While extraction is a plausible supporting step for a URL-to-audio tool, this chunk contains none of the core advertised behavior: no TTS engine calls, no Kokoro integration, no audio buffering, no MP3 generation, and no playback/download handling. Additionally, the code prominently targets AI chat sites (ChatGPT, Claude, Gemini, DeepSeek, Kimi, etc.), which is broader/different from the user-facing description focused on webpages/articles/books. Therefore the description materially overstates and misrepresents what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description emphasizes URL-to-audio conversion, natural AI speech, podcast-quality MP3 output, and reading synced books aloud. However, this code chunk is limited to extracting clean article text from a webpage using Puppeteer and an extractor bundle, then printing JSON. While text extraction could be a supporting step for a TTS pipeline, the supplied code does not implement or demonstrate any audio synthesis, media output, or book-platform integration. Therefore the behavior shown is materially narrower and different from the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description emphasizes converting a URL or web page into audio and also reading synced books from specific platforms. However, this code only accepts a local text file path as input and performs text-to-speech generation by calling an external CastReader API endpoint. There is no logic for fetching a URL, parsing webpage content, handling browser/article extraction, or integrating with WeChat Reading/Kindle libraries. The core implemented behavior is narrower and materially different: text-file-to-MP3 TTS, not URL-to-audio or book-sync reading. The API key point is also inconsistent with the description, since the code supports bearer-token authentication through an environment variable.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The core behavior does align substantially with 'URL to audio': the script takes a URL, extracts article content, and generates MP3 speech using a Kokoro-based TTS backend. However, there are material description-behavior gaps. First, the description explicitly says 'no API key needed,' yet the implementation is built around a remote API service and conditionally uses a bearer token from CASTREADER_API_KEY, so the claim is not supported by code. Second, the description advertises reading synced books from WeChat Reading / Kindle library aloud, but this code chunk contains no book-library integration or related logic. Thus the description overstates capabilities beyond what the supplied code demonstrates.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sync-books.js --list
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The bundle includes extractors for multiple AI chat platforms that collect assistant responses and related content. In the context of an article/audio reader skill, this is dangerous because users may unknowingly expose private chat transcripts, generated code, or sensitive prompts through an unexpectedly broad extraction feature set.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The bundle contains special extractors for AI chat services and collaborative document platforms far beyond the advertised 'URL/article/book to audio' scope. That scope expansion means the skill can access and serialize sensitive conversation and document content a user may not expect to be processed, increasing privacy and overcollection risk.
- Content
Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
extract-zip 2.0.1 is a real risky transitive dependency because Puppeteer uses @puppeteer/browsers to download and extract browser archives during install/runtime workflows. If an attacker can influence the downloaded archive source, cache, mirror, or network path, symlink path traversal during extraction could enable arbitrary file overwrite on the host.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
ws 8.19.0 is a genuine security concern because Puppeteer relies on WebSocket communication with Chromium through puppeteer-core. If an attacker can interact with or influence the DevTools/WebSocket channel, the memory disclosure or memory exhaustion conditions could affect confidentiality or availability of the skill runtime.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README strongly markets 'Paste a URL, get an MP3' and 'No API key required' but does not clearly disclose that URLs and extracted page text may be sent to a remote service via the configurable CASTREADER_API_URL endpoint. Because this skill handles arbitrary webpages and even synced book content, the omission creates a real privacy and data-handling risk: users may submit sensitive URLs, paywalled content, personal documents, or copyrighted text without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrase set is broad for a skill that activates on natural-language requests like reading articles aloud, and the README example reinforces generic invocation such as 'read this'. In an agent ecosystem, overly generic triggers can cause accidental activation on ordinary conversation or unintended URLs/text, which may lead to unplanned network access and content exfiltration to the skill's backend.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes local Node scripts that can perform network access and interact with local environment state, yet the manifest declares no explicit tool scope or permissions boundary. In practice this weakens reviewability and least-privilege controls, making it easier for a user to trigger behavior with broader access than the description clearly discloses.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match many ordinary requests like 'read aloud' or 'text-to-speech,' increasing the chance the skill activates unintentionally. Because the skill can fetch URLs, access synced book metadata, and generate/send files, accidental invocation could expose content or perform unwanted networked processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs enumerating the user's synced book library and exposing titles, authors, and related metadata in chat without any privacy notice or consent gate. Library contents can reveal sensitive interests, political or medical topics, and account-linked personal behavior, so disclosing them by default creates a real privacy risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This bundle contains natural-language and language-selection logic that forces Chinese (
"zh") for specific services such as WeChat, WeRead, Fanqie, and some document extractors, regardless of user preference. That is a locale-policy issue because the skill does not offer a language choice or indicate that it is intentionally limited to a Chinese-only regional context.- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/generate-text.js:16
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/read-url.js:29
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/sync-books.js:38