rabbit-reads

• Outcome: Review
• Latest audit: Aug 30, 2026 · 5:48 PM UTC
• Version: 0.5.0

Overview

The reading-notes workflow is coherent, but the package also ships mismatched writing-scanner, hook, rewrite, file-edit, and optional model-endpoint code that goes beyond that purpose.

Install only if you are comfortable with this package containing the broader rabbit-writes engine, not just a read-only note generator. Avoid enabling claude_hook.py or running scan.py with --apply-model or --write unless you intentionally want hook behavior, external model processing, or in-place edits, and verify any .rabbit-model endpoint before sending private documents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions, but its instructions clearly require shell execution, file reads/writes, environment-variable access, and optional network use via an OpenAI-compatible endpoint. This creates a trust-boundary mismatch: a host or reviewer may treat the skill as low-privilege while it actually directs broad local actions and possible outbound data transfer of normalized source text.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose presents the skill as a reading/distillation workflow, but the embedded behavior reaches much further: scanning hooks, safety/fingerprint analysis, model-backed rewriting, mechanical fixes, and PR/commit-message rewriting. That hidden functional breadth is dangerous because users may invoke a benign-seeming summarization skill without realizing it can inspect additional files, alter documents, or send content to configurable remote endpoints.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The SECURITY.md content describes a different bundle ('rabbit-writes' / a prose scanner with optional networked model application and host-install behavior) rather than the manifested skill 'rabbit-reads'. This kind of security-documentation mismatch is dangerous because it can conceal actual capabilities, mislead reviewers about the real attack surface, and suggests the packaged skill may contain copied or mixed components not disclosed by its metadata.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: This section explicitly documents networked 'apply-model' behavior for a scanner workflow, which contradicts the stated purpose of rabbit-reads as a document-distillation skill. Undisclosed or mismatched network capabilities raise exfiltration and trust-boundary concerns, especially because users may provide sensitive books, papers, or private documents to the skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's behavior is materially unrelated to the declared `rabbit-reads` purpose and instead implements a `rabbit-writes` hook that scans prose, enforces voice behavior, and modifies tool inputs. That kind of capability mismatch is dangerous because users and reviewers may grant the skill access under a harmless document-distillation pretext while hidden code influences other workflows and repository actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code intercepts Bash tool use and rewrites `git commit` and `gh pr create` message bodies, which exceeds the legitimate scope of a skill that should only read source documents and generate notes. Silent modification of commit/PR text can conceal provenance, alter audit trails, or manipulate what gets recorded in version control and code review systems.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script performs prose voice scanning/enforcement unrelated to document-reading or doc-set generation, indicating hidden side functionality inside a skill that users would reasonably expect to be limited to content extraction and summarization. In the skill context, this mismatch is more dangerous because it broadens the operational footprint beyond what a user would authorize or scrutinize.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring and emitted messages repeatedly identify the behavior as `rabbit-writes`, directly contradicting the declared `rabbit-reads` identity. This is a strong indicator of repackaged or intentionally mislabeled functionality, which undermines trust and can be used to smuggle unexpected behavior past reviewers under benign branding.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This module sends user-supplied document text to a configurable chat-completions endpoint, which creates a real exfiltration path for sensitive drafts or unpublished material. Although the code includes meaningful safeguards (TLS requirement for non-loopback by default, key scrubbing, and warnings for repo-local config), the core behavior is still security-sensitive because a malicious or untrusted configuration can direct content to an attacker-controlled remote service.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements model-backed rewriting for style and lint findings, which is materially different from the manifest's stated purpose of distilling books, papers, or theses into cheatsheet doc sets. This capability mismatch is dangerous because hidden or undeclared behaviors can bypass user expectations, policy review, and least-privilege assumptions, enabling the skill to process content in ways operators did not authorize.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends passages to a model endpoint for rewriting, but that external model-edit capability is not justified by the manifest for a document-distillation skill. Even if the feature is not overtly malicious, undeclared model invocation expands the attack surface and can expose user content to external processing outside the expected task boundary.

Description-Behavior Mismatch

Critical

• Confidence: 98% confidence
• Finding: The file clearly implements a rabbit-writes scanning/rewriting tool rather than a rabbit-reads distillation skill. In a skill system, this capability mismatch is dangerous because users invoking a read-only summarization skill could instead trigger scanning, model-backed rewriting, and file-modification behaviors that exceed the declared trust boundary.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This section introduces model-backed network rewriting, including endpoint resolution and sending document passages to an OpenAI-compatible service. For a skill advertised as converting documents into cheatsheets, exfiltrating content to a network service and performing remote rewrites is an unjustified capability expansion that can leak sensitive source material and alter data unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This code supports mechanical fixes and atomic in-place write-back of user files, which is outside the expected behavior of a read/distill skill. Unexpected file modification raises integrity risk: source documents can be altered or overwritten when users reasonably expected extraction or note generation only.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module docstring explicitly says this is part of rabbit-writes, contradicting the advertised rabbit-reads identity. This inconsistency is a strong indicator of packaging or provenance mismatch, which undermines operator trust and can hide materially different capabilities than those users intended to install or run.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The prompt instructs subagents to write exact files to the filesystem, but it does not require any explicit user confirmation or safety check before modifying files. In an agent setting, this can lead to unintended file creation or overwriting if the surrounding workflow passes unsafe paths or if the user did not clearly authorize write operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code may transmit user-provided text to an external model endpoint without any user-facing notice or consent mechanism in the file. In the context of a skill expected to ingest PDFs, theses, and papers, that can leak sensitive manuscript, research, or proprietary content to third-party services, making the mismatch more dangerous than in a clearly remote-only rewriting tool.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

- It writes four paths and no others: two markdown files under
  `~/.claude/output-styles/`, the `hooks` and `outputStyle` keys inside
  `~/.claude/settings.json`, and a record of those at
  `~/.claude/rabbit-writes-host.json`.
- `--dry-run` prints every one of them and writes nothing, and the skill's
  own instructions require showing that output to the user before running the

• Confidence: 95% confidence
• Finding: The file states that a script writes into ~/.claude/settings.json and related agent configuration paths. Even though the text claims this belongs to a different bundle, its presence in this skill's security documentation indicates possible cross-bundle host modification behavior, which is highly sensitive because it can persist hooks, alter output styles, and change future agent behavior outside the skill's own workspace.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/rwlib/endpoint.py:54