manage

Warn

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches several external artifacts during the setup and update processes.
  • Downloads the Kindle for PC installer from Amazon S3 (kindleforpc.s3.amazonaws.com).
  • Downloads DeDRM tools from a fork on GitHub (github.com/Satsuoni/DeDRM_tools).
  • Downloads a utility called Kindle_Key_Finder from techy-notes.com, an unverified third-party technology blog.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code downloaded from unverified remote sources.
  • The Kindle_Key_Finder package contains multiple executables (KFXKeyExtractor282.exe, KFXArchiver283.exe) and scripts that are intended to be run with administrative privileges.
  • The update action instructs the agent to update SHA256 integrity pins in references/versions.md if the upstream source changes, which could lead to the acceptance of malicious updates if the hosting site is compromised.
  • [COMMAND_EXECUTION]: The skill performs administrative system modifications through shell commands.
  • Uses PowerShell to create and enable outbound blocking rules in the Windows Firewall (New-NetFirewallRule).
  • Executes icacls to set DENY permissions on the Kindle updates directory, requiring administrative access.
  • The cleanup.sh script utilizes eval to execute command strings constructed within the script.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 30, 2026, 07:56 PM
Security Audit — agent-trust-hub — manage