cli-anything-calibre
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the package directly from a remote GitHub repository (github.com/HKUDS/CLI-Anything.git) using pip, which bypasses official package registries.
- [COMMAND_EXECUTION]: The harness functions by executing system-level binaries such as 'calibredb', 'ebook-convert', and 'ebook-meta', passing arguments to perform file system and library modifications.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process various e-book formats (EPUB, PDF, MOBI, etc.) from external sources; these files can contain hidden instructions that may attempt to override the AI agent's behavior during content extraction or metadata analysis.
Audit Metadata