Security audit

kindle-download

Security checks for vulnerabilities and agentic risk

Overview

This Kindle ebook skill is mostly aligned with its stated purpose, but it needs review because it uses stored account credentials for live website login and email sending while leaving some network, session, and invocation behavior under-scoped.

Install only if you are comfortable giving this skill a Z-Library account, an SMTP sending credential, and permission to download files and email them to your Kindle. Use dedicated or app-specific credentials, verify the mirror domains in zlibraryUrl.json, avoid untrusted proxies, keep auth.json locked down or use environment variables, and clear /tmp/kindle_downloads after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares and uses powerful capabilities including environment credential access, local file read/write, and network communication, but does not expose an explicit permissions model to constrain or inform these actions. In this context, the skill handles SMTP credentials, third-party site credentials, local auth files, downloads files to disk, and transmits content externally, so missing permission declarations reduces transparency and increases the risk of over-privileged execution or misuse.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The script reads configuration from fixed home-directory paths, including proxy settings and potentially authentication-related data, without any visible user consent or tight scoping to the immediate download action. For a narrowly scoped book-download skill, accessing user-local config outside explicit runtime inputs expands the skill's privileges and can silently influence where traffic is sent or what credentials are used.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script reads multiple sensitive credentials from environment variables and a local auth.json, including SMTP and third-party library account secrets, which goes beyond the immediate user-supplied book title input. Even if needed for functionality, this expands the skill's access to local secrets and creates unnecessary trust in local state without clear scoping or minimization.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill stores browser login state and workflow state in the system temporary directory, which can expose authenticated session material and search history to other local processes or later users of the same machine. Temporary directories are often less protected and more likely to retain sensitive artifacts than in-memory state.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README states that the skill automatically downloads ebooks from Z-Library and emails them to a Kindle, but it does not clearly disclose the full external data flows or associated privacy/security risks. Users are asked to configure SMTP credentials, Kindle email, Z-Library credentials, and optional proxy settings, yet the documentation does not explicitly warn that these secrets and downloaded content will be used with third-party services and remote sites.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrase "帮我下载电子书" is broad enough to activate the skill outside its intended Kindle-specific workflow, which can cause the agent to initiate credentialed searches, downloads, or email delivery in response to ambiguous requests. Because this skill logs into a third-party source and sends files via SMTP, accidental invocation has meaningful security and privacy consequences beyond simple UX confusion.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill does not prominently disclose that it will use stored credentials to sign into a third-party site and send downloaded files through SMTP to a Kindle address, even though it collects and uses multiple sensitive secrets. This weak disclosure undermines informed consent and can surprise users into authorizing actions that expose account data, downloaded content, and email activity to external services.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends optional cookies in the request headers and may route the request through a configured proxy, but there is no explicit warning, confirmation, or host validation before transmitting those credentials. In this skill context, users may believe they are only downloading an ebook, while their session cookies could be sent to arbitrary URLs or through an untrusted proxy, creating credential leakage risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Persisting browser login state to disk creates a reusable authenticated session artifact that may allow account takeover if accessed by another local user or process. The absence of explicit user notice worsens the risk, but the core issue is the sensitive session persistence itself.

Session Persistence

Medium

Category: Rogue Agent
Content: 配置文件存储在用户主目录下，不包含在技能目录中，提高了安全性。 ```bash mkdir -p ~/.config/kindle-download cp ~/.openclaw/workspace/skills/kindle-download/auth.json.example ~/.config/kindle-download/auth.json ```
Confidence: 73% confidence
Finding: The README instructs users to store long-lived SMTP and Z-Library credentials in a persistent plaintext file under the user's home directory. Although keeping secrets outside the repository is better than committing them, persistent local secret storage still increases exposure to credential theft from local compromise, backups, misconfigured permissions, or other processes running as the same user.

Static analysis

No suspicious patterns detected.