reading-notes-genie

• Outcome: Review
• Latest audit: Aug 6, 2026 · 8:54 AM UTC
• Version: 0.1.0

Overview

The skill appears purpose-aligned, but it can send uploaded PDF/EPUB book text to external or user-configured AI endpoints without a clear consent/privacy warning.

Install only if you are comfortable with book titles and uploaded document text being processed by the configured AI provider. Use offline mode or a trusted local endpoint for private, copyrighted, regulated, or confidential documents, and consider pinning/auditing dependencies before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'req' from os.environ.get (line 158, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

data = _json.dumps(payload).encode()
            req = urllib.request.Request(url, data=data,
                headers={"Content-Type": "application/json"})
            with urllib.request.urlopen(req, timeout=120) as r:
                resp = _json.loads(r.read())
            return resp.get("response", "")
        except Exception as e:

• Confidence: 92% confidence
• Finding: with urllib.request.urlopen(req, timeout=120) as r:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and instructs use of file access, shell execution, environment variables, and network calls, but does not declare permissions or clearly scope them. In this context, users may upload private books or documents and the skill may transmit content to external model providers or access local files without explicit consent, creating a meaningful confidentiality and integrity risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly promotes AI network querying and use of external model APIs, but it does not clearly warn users that book titles and potentially uploaded PDF/EPUB contents may be sent to third-party services. In a document-processing skill, this creates a real privacy and data-governance risk because users may unknowingly transmit copyrighted, sensitive, or personal material to external providers.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad everyday phrases such as 做筆記, 書摘, and 金句, which can cause the skill to activate in contexts where the user did not intend document upload, web lookup, or summarization behavior. In a skill with file and network capabilities, over-broad invocation increases the chance of accidental processing or disclosure of sensitive content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes uploading PDFs/EPUBs and querying by book title, but does not warn users that content or queries may be sent to external AI providers or other network services. Because uploaded documents can contain copyrighted, personal, or confidential material, omission of this disclosure can lead to unintended exfiltration and compliance/privacy issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends chapter or book content to external model providers (OpenAI, Anthropic, or a configured local endpoint) without an explicit warning, consent gate, or data-minimization control. In this skill context, users may upload entire books or documents, so the privacy and confidentiality impact is significant if copyrighted, personal, or sensitive material is transmitted unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Core
requests
# PDF
pypdf>=4.0.0
pdfplumber>=0.10.0

• Confidence: 97% confidence
• Finding: requests

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Core
requests
# PDF
pypdf>=4.0.0
pdfplumber>=0.10.0
# EPUB
# (stdlib zipfile + xml.etree.ElementTree — no extra dependency)

• Confidence: 95% confidence
• Finding: pypdf>=4.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
# PDF
pypdf>=4.0.0
pdfplumber>=0.10.0
# EPUB
# (stdlib zipfile + xml.etree.ElementTree — no extra dependency)
# AI

• Confidence: 91% confidence
• Finding: pdfplumber>=0.10.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# EPUB
# (stdlib zipfile + xml.etree.ElementTree — no extra dependency)
# AI
openai>=1.0.0
anthropic>=0.18.0
# Anki export
genanki>=0.0.35

• Confidence: 88% confidence
• Finding: openai>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# (stdlib zipfile + xml.etree.ElementTree — no extra dependency)
# AI
openai>=1.0.0
anthropic>=0.18.0
# Anki export
genanki>=0.0.35
# PDF report

• Confidence: 88% confidence
• Finding: anthropic>=0.18.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
anthropic>=0.18.0
# Anki export
genanki>=0.0.35
# PDF report
reportlab>=4.0.0
# Optional: OCR

• Confidence: 86% confidence
• Finding: genanki>=0.0.35

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Anki export
genanki>=0.0.35
# PDF report
reportlab>=4.0.0
# Optional: OCR
# tesseract (system-level, install via: brew install tesseract)
# pytesseract>=0.3.10

• Confidence: 90% confidence
• Finding: reportlab>=4.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: requests

Known Vulnerable Dependency: pypdf==4.0.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: pypdf==4.0.0

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.