manage
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches several external artifacts during the setup and update processes.
- Downloads the Kindle for PC installer from Amazon S3 (
kindleforpc.s3.amazonaws.com). - Downloads DeDRM tools from a fork on GitHub (
github.com/Satsuoni/DeDRM_tools). - Downloads a utility called
Kindle_Key_Finderfromtechy-notes.com, an unverified third-party technology blog. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code downloaded from unverified remote sources.
- The
Kindle_Key_Finderpackage contains multiple executables (KFXKeyExtractor282.exe,KFXArchiver283.exe) and scripts that are intended to be run with administrative privileges. - The
updateaction instructs the agent to update SHA256 integrity pins inreferences/versions.mdif the upstream source changes, which could lead to the acceptance of malicious updates if the hosting site is compromised. - [COMMAND_EXECUTION]: The skill performs administrative system modifications through shell commands.
- Uses PowerShell to create and enable outbound blocking rules in the Windows Firewall (
New-NetFirewallRule). - Executes
icaclsto set DENY permissions on the Kindle updates directory, requiring administrative access. - The
cleanup.shscript utilizesevalto execute command strings constructed within the script.
Audit Metadata