ClawHub
Back to skill

Security audit

book-breakdown

Security checks for vulnerabilities and agentic risk

Overview

This book-summary skill is purpose-aligned, but users should be aware it can read supplied book files, search the web for book information, and create local report files.

Install only if you are comfortable with the agent reading the book files you provide, performing web lookups about the books or links you mention, and saving local report files by default. For sensitive reading material, ask for a pure-text or offline-only response and avoid opening generated HTML reports with network access until the external font link is removed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
templates/book-report-template.html:7
Finding

External Font Dependency Violates the Self-Contained Report Guarantee

Content
View full analysis

Vulnerability Details

File Location: templates/book-report-template.html, line 7
Vulnerability Type: External third-party resource loading
Risk Level: Low

html
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&family=JetBrains+Mono:wght@500;700&display=swap" rel="stylesheet">

Technical Analysis

The report template loads a stylesheet from Google Fonts whenever a generated HTML report is opened with network access. This conflicts with the Skill's explicit requirement that generated HTML be self-contained, have no external dependencies, and work offline.

The browser sends a request to fonts.googleapis.com, and the returned stylesheet can cause additional requests to external font-hosting infrastructure. These requests disclose network and client metadata such as the viewer's IP address, user agent, access time, and potentially referrer information subject to browser policy.

The externally hosted stylesheet is also mutable outside the audited project. Although the reviewed code does not load a script or directly execute a remote payload, report appearance and availability depend on third-party content that can change after the package has been reviewed.

Attack Path

  1. The Skill uses the template to generate a book-report HTML file.
  2. A user opens the report in a browser while connected to the network.
  3. The browser requests the external stylesheet from fonts.googleapis.com.
  4. The response references externally hosted font resources, which the browser may also request.
  5. External providers receive request metadata, and report rendering becomes dependent on remotely controlled resources.

Impact Assessment

No local privileges, code-execution capability, or system access are obtained through the reviewed markup.

The confirmed scope is limited to:

  • Disclosure of the viewer's IP address, user agent, access timing, and related HTTP metadata to external providers.
  • Loss of guaran ...[truncated 194 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the external Google Fonts <link> element.
  2. Use the system-font fallback stack already present in the template:
    css
    font-family: -apple-system, "PingFang SC", "Microsoft YaHei", sans-serif;
  3. Replace the JetBrains Mono dependency with a local monospace stack:
    css
    font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
  4. If custom fonts are essential, vendor reviewed font files within the project and embed them as data URLs using @font-face, after confirming licensing and file integrity.
  5. Add an automated check that rejects external resource references such as http://, https://, protocol-relative URLs, remote @import rules, and remote url(...) declarations in generated reports.
  6. Test generated reports with networking disabled to verify that all required styling and content remain available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough to match many ordinary book-related requests, which can cause the skill to activate when the user did not intend to invoke it. Because this skill can then initiate follow-up processing, file generation, and network retrieval, overbroad activation expands the chance of unintended data handling and tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill defaults to creating Markdown and HTML files, including a self-contained HTML report, without requiring explicit user consent at the moment of file creation. This can lead to unexpected writes in the workspace, possible persistence of sensitive book contents or user notes, and confusion about what artifacts were stored locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs use of web search and page fetching for metadata, reviews, and chapter information without a clear user-facing notice that network requests may be made based on the provided book title, link, or document context. This can expose user interests or supplied URLs to external services and may fetch untrusted content unnecessarily, creating privacy and prompt-injection exposure through remote pages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTML root sets lang="zh-CN", which forces a specific language/locale for the rendered document. In this file there is no accompanying indication that the locale is optional, user-selected, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.