Security audit

book-recommendation-engine

Security checks across malware telemetry and agentic risk

Overview

This is a coherent book recommendation skill that uses disclosed book-data lookups and local reading-list files, with no evidence of hidden, deceptive, destructive, or unrelated behavior.

Install only if you are comfortable with a book tool storing your library, ratings, wishlist, and price history locally under your home directory and sending book queries or ISBNs to external book/search sites when you use live lookup, web-summary, or price-check features.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable scripts with file read, file write, and network capabilities but does not declare corresponding permissions or clearly surface them to users. This creates a transparency and trust problem: users or hosting systems may invoke a skill that can access local data, modify files, and contact external services without explicit prior acknowledgment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose frames the skill as a book recommendation tool, but the described behavior extends into broader web fetching, local library/user-rating persistence, author/book detail retrieval, and Markdown file generation. This mismatch is dangerous because users may grant trust for a narrowly scoped recommender while the skill actually performs additional network collection and local data manipulation beyond what is plainly disclosed.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Trigger phrases such as generic everyday requests increase the chance of accidental invocation in unrelated conversations. Unintended activation matters here because the skill can perform network requests and local state changes, so a casual phrase could cause data fetching or modification without the user realizing this specific skill was engaged.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The description mentions Open Library features but does not clearly warn that the skill performs outbound network access and may fetch additional web content. Lack of disclosure reduces informed consent and can surprise users in restricted or privacy-sensitive environments where external requests are significant.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: Wishlist and price-tracking features imply retention of user preferences, reading plans, and possibly price history, yet the description does not warn about this data handling. Even if the data is only local, undisclosed persistence can expose personal interest profiles or create unexpected stored state on shared systems.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.