圖書館管家 Plus

• Outcome: Review
• Latest audit: Aug 7, 2026 · 6:35 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its library-management purpose, but it can modify Notion pages and run scheduled reminders with unclear scoping around Notion access and stored credentials.

Install only if you are comfortable giving the skill a Notion integration token for the relevant library database. Use a token shared only with that database, avoid embedding long-lived secrets in cron messages if your platform logs them, review exports before sharing them, and enable cron reminders only after confirming the schedule and notification audience.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documents capabilities that imply network access, local file writes, and shell-based cron setup, but it declares no permissions. This weakens user consent and platform enforcement because the agent may perform data access, persistence, and scheduled actions without an explicit security boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The documented behavior expands beyond the headline description into persistent local logging, automated cron reminders, HTML dashboard generation, and broader Notion CRUD/archive operations. This creates a transparency and consent problem: users may authorize a library helper without realizing it stores reading-history data locally and performs recurring background processing.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic Notion synchronization and overdue reminders but does not clearly warn users that book records, borrower names, due dates, and related metadata may be continuously transmitted to an external service and used in automated notifications. This can lead to unintended disclosure of personal or sensitive library data and surprise automated actions, especially in shared or semi-public deployments.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The documentation promotes unattended daily cron-based overdue checks and proactive reminders without warning that the skill may perform actions automatically without a live user review. In practice this can cause unexpected reminders, noisy behavior, or disclosure of borrower status if notifications are sent to the wrong audience or on shared systems.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The cron example hard-codes the Asia/Taipei time zone without noting that users should change it, which can cause reminders and overdue processing to run at unintended times. While not directly exploitable as code execution, it can create operational errors, mistimed notifications, and privacy issues if reminders are sent outside expected hours.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad everyday terms such as reading check-in and generic library/book phrases, increasing the chance of accidental activation in unrelated conversations. Unintended activation is dangerous here because the skill can touch Notion data, write local files, and potentially initiate reminder workflows based on ambiguous user input.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill advertises proactive reminders and overdue notifications but does not clearly disclose that borrowing and reading-progress data may be processed on a recurring automated basis. Because the tracked data can reveal habits and named borrowers, insufficient notice can lead to unexpected privacy exposure and background monitoring.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The export functions write borrower-related fields such as '借出給', '借出日期', '預定還日', and '歸還日期' directly into CSV and Markdown outputs without any consent prompt, redaction option, or warning that personally identifying borrowing history will be included. In a library-tracking context, this creates a real privacy risk because exported files are easy to share, sync, or store insecurely, exposing patron activity beyond the original Notion access controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The generated report can include personally identifying borrower information and overdue status, and the script writes that content directly to an arbitrary output file with no redaction, consent check, or warning about sensitive contents. In a library-tracking context this is privacy-sensitive operational data, so accidental disclosure through shared directories, backups, or exports is a realistic risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.