Security audit

findTheBook

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its book-search purpose, but its URL checks are too loose and could make the runtime fetch attacker-controlled or internal network URLs.

Review this before installing in any environment with access to private network services. Prefer running it in a restricted network sandbox, pinning dependencies, and validating URLs strictly to official Douban and WeChat Reading hosts before fetching.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
requests== beautifulsoup4== ``` 2. Generate and retain hashes for direct and transitive dependencies, then install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 3. Use a dependency-locking tool to produce a reproducible transitive dependency graph. 4. Install packages only from an explicitly configured, trusted package repository. 5. Prefer reviewed binary wheels where appropriate and avoid untrusted source-package build execution. 6. Add automated dependency vulnerability and provenance scanning to release reviews. 7. Run the Skill in an isolated environment under a minimally privileged service account. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bookFinder.py:51
Finding: Weak URL Validation Permits Attacker-Controlled Outbound Requests and Redirect-Based SSRF
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language instructions, examples, and output requirements are entirely in Chinese and assume Chinese-language interaction, but the file does not explicitly state that the skill is Chinese-only or offer user opt-in for language preference. Under the policy, forcing a specific language without user choice or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly states it will automatically look for direct WeChat Reading links, but it does not warn users that it is retrieving external reading-resource links beyond Douban metadata. This can mislead users about the nature and legitimacy of outbound links and may increase the chance of users following unexpected or untrusted resources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and parameter descriptions are written entirely in Chinese, indicating the skill is designed around a specific language/locale. Under the policy, forcing a language without offering user choice or clearly documenting a justified locale restriction is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code contains user-facing natural-language content in Chinese, including the docstring and later debug/warning output, but does not indicate that the skill is Chinese-only or provide any opt-in for language preference. That can violate language/locale policy when a skill implicitly forces one language for users in a general context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill emits natural-language output and logs in a fixed language style rather than offering a user choice or clearly scoping the tool to a specific locale. Under the stated policy, forcing a language/locale without opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.