Library Book Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:15 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent library availability monitor, but it needs Review because broad triggers and permissions combine with weak email notification controls that can expose reading-interest data.

Review before installing. Use it only if you are comfortable with a skill that can run shell commands, read/write local files, contact Shenzhen Library, and optionally send book details through your SMTP provider. Do not place a primary email password in config.yaml; prefer a dedicated app password or remove email from methods. Be aware that setting notification.enabled: false does not stop notifier initialization in this version if email remains configured.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: notifier.py:84

Finding

Documented Notification Opt-Out Is Not Enforced

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: notifier.py:45

Finding

SMTP Credential Is Stored in Plaintext Configuration

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unused and Loosely Constrained Dependencies Expand the Supply-Chain Surface

Content

View full analysis

=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 schedule>=1.2.0 python-dotenv>=1.0.0 pyyaml>=6.0 ``` ### Technical Analysis All dependencies use open-ended lower-bound constraints. A future installation may therefore resolve to versions that were never reviewed with this Skill. No hashes or lock file are supplied to establish package integrity and reproducible resolution. The audited Python source uses `requests`, `schedule`, and `yaml`. No imports or runtime use of `beautifulsoup4`, `lxml`, or `python-dotenv` were found. Those three packages consequently expand the installation and transitive-dependency surface without supporting the current implementation. `lxml` also introduces an avoidable native-extension component. This is a supply-chain hardening issue. The audit found no evidence that the named packages are intentionally malicious, typosquatted, or currently compromised. ### Attack Path 1. A user runs `pip install -r requirements.txt` as instructed. 2. The package resolver selects any future release satisfying each `>=` constraint. 3. Installation downloads packages and transitive dependencies not cryptographically fixed by the project. 4. Package installation or import-time code executes in the user's Python environment. 5. If a selected future package or dependency is compromised, malicious, or unexpectedly incompatible, it can affect the user with the privileges used for installation or execution. The unused dependencies increase the number of components through which this path could arise. ### Impact Assessment If a dependency or transitive dependency were compromised, impact could include code execution with the installing user's privileges, access to files readable by that user, network access, and manipulation of the ...[truncated 143 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: _meta.json:24

Finding

Declared Agent Tools and Permissions Exceed Minimum Functional Requirements

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which pulls and executes the latest published package at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package or one of its dependencies is compromised, users may execute attacker-controlled code during installation, and the skill's declared shell/network/filesystem context makes such execution more consequential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README includes plaintext SMTP credential configuration, including an email password field, without warning users about secret handling, use of app-specific passwords, or the risk of committing credentials to disk or source control. In practice, users often copy this into config.yaml, which can lead to credential leakage, unauthorized mailbox access, and unintended transmission of reading activity or personal data to external email infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The trigger set as a whole does not sufficiently constrain when the skill should activate, especially for generic book-availability or library-related requests. In a skill with elevated permissions, ambiguous activation expands the attack surface by increasing accidental invocation and execution of shell-backed workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase library is extremely broad and can activate during ordinary conversation unrelated to monitoring books. Overbroad activation can cause the agent to invoke a skill with network, filesystem, and shell permissions in contexts where the user did not clearly intend it, increasing the chance of unintended actions or data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description and usage notes do not clearly warn users that monitored book data is stored locally and that email notifications require sensitive SMTP credentials. This creates a transparency and privacy risk: users may unknowingly persist reading-interest data on disk or configure credentials without understanding how they are handled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list contains very broad phrases such as "library", "图书馆", and "借书" that are likely to match ordinary user requests unrelated to this specific monitoring skill. Because the skill has network, filesystem, and shell permissions, accidental activation expands the chance that a general conversation is routed into a privileged skill context, increasing misuse and unexpected side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file contains natural-language docstrings and comments exclusively in Chinese, including user-relevant descriptions such as class and method purposes. Under the policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file's user-facing natural-language strings in docstrings and error messages are exclusively in Chinese, with no indication that the skill offers a language choice or is explicitly limited to a Chinese-language context. Under the stated policy, forcing a specific language without user opt-in can constitute a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The scraper hard-codes Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific locale preference in network requests. Under the policy, forcing a language/locale without user opt-in or clear documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's docstrings, status messages, email subject, and formatted notification content are all hard-coded in Chinese. Because there is no user opt-in, fallback, or configurable locale selection, this creates a language-policy issue if the skill is expected to operate in general contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "library" is so broad that it can match many ordinary user requests unrelated to this skill, causing the agent to invoke a network/filesystem/shell-capable skill in unintended contexts. Because this skill has elevated permissions, accidental activation increases the chance of unnecessary external requests or other side effects beyond the user's actual intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "图书馆" is similarly broad and can activate on many generic Chinese-language requests about libraries, not specifically book availability monitoring. In a skill with network, filesystem, and shell permissions, ambiguous triggering expands the attack surface by making unintended execution more likely during normal conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The class docstring is written only in Chinese, and the file consistently presents user-facing messages in Chinese, indicating a fixed locale assumption. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence

Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 81% confidence

Finding

The trigger 借书 is very short and semantically broad, so it may match many normal Chinese-language borrowing discussions that are not requests to run this skill. While the direct impact is limited, unintended activation is still risky because the skill can invoke shell commands and access local/network resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This file includes a natural-language skill title in Chinese, but provides no indication that language selection is optional or that the skill is intentionally scoped to Chinese-speaking users. Under the policy, fixed language presentation without user opt-in can be a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This Python file contains natural-language descriptions, help text, examples, and user-facing output exclusively in Chinese. Under the policy criteria, forcing a specific language without offering the user a language choice or opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes monitoring library book availability and notifying the user, but it does not explicitly scope notification channels to external email delivery. Implementing SMTP-based email sending introduces a broader outbound communication capability that is not clearly justified by the stated purpose alone.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification for requests uses a lower-bound only constraint, which permits installation of many different future versions and makes builds non-reproducible. This increases supply-chain risk because a vulnerable or breaking version could be resolved at install time without review, especially in a skill with network permission that relies on HTTP interactions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
schedule>=1.2.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether deployed installations are using a patched release. In a network-enabled skill that likely fetches library data over HTTP/HTTPS, an affected requests version could expose credentials or weaken transport security handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

beautifulsoup4 is not pinned to an exact version, so dependency resolution may pull in different releases over time. While this is not directly exploitable by itself, it weakens build integrity and can introduce unreviewed changes or vulnerable transitive dependencies.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
schedule>=1.2.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

lxml is specified with only a minimum version, which allows unreviewed versions to be installed and makes it hard to determine exposure to known parser-related vulnerabilities. Because lxml processes structured content and this skill has network access, an unsafe resolved version could increase risk from malicious remote content.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
schedule>=1.2.0
python-dotenv>=1.0.0
pyyaml>=6.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

lxml has a history of security advisories, and the lack of exact version pinning means the actual installed version cannot be verified as patched. Since this skill appears to parse remote content from library systems, using an affected parser version could increase exposure to maliciously crafted HTML or XML.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.