Security audit

capsule-bookshelf-skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a local book-summary HTML generator with disclosed file writes, though users should notice that it updates a persistent local bookshelf automatically.

Install this only if you want a skill that automatically creates local HTML files and maintains a persistent bookshelf registry. Review generated quote content before sharing publicly, especially for accuracy and copyright, and be aware that some trigger phrases may invoke a state-changing workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly directs the agent to write JSON and HTML files and to update registry/book shelf files, yet no declared permissions are present. This creates a capability/consent mismatch: reviewers or runtime policy may underestimate the skill's file-system effects, increasing the chance of unintended writes or unsafe deployment.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to invoke a general shell via shell_executor to run Python, which grants a far broader execution surface than the business task requires. If variables such as the generated filename or paths are not strictly validated by the caller/runtime, this can enable command misuse, arbitrary code execution paths, or expansion of the skill's privileges beyond article generation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "做书摘" is broad and closely matches ordinary user requests to make excerpts or summarize reading material, so the skill may activate when the user did not intend to invoke it. This can cause unintended execution of the skill's behaviors, including content generation and possible downstream save/publish actions described in the metadata.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase "来颗胶囊" is colloquial and ambiguous, making accidental invocation more likely in normal conversation. In a skill that can generate artifacts and potentially store or publish them, accidental activation increases the risk of unintended processing or side effects.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The description states the skill can "存到本地或推送到公众号" without warning the user that it may modify local data or publish content externally. This creates a consent and transparency problem: users may invoke a summarization skill expecting passive output, but the skill advertises state-changing behavior with potential privacy and publication consequences.

VirusTotal

44/44 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.