스킬 bookforge

📦

bookforge

Name: bookforge
Author: gongnyang

콘텐츠 리비전 r1 높은 위험 📁 파일 시스템 접근🌐 네트워크 접근⚙️ 외부 명령어🔑 환경 변수⚡ 스크립트 포함

Create Korean Ebook PDFs from Topics or Manuscripts

Preparing a Korean PDF book requires consistent content structure, typography, and pagination. Bookforge combines six design styles with guided writing, local rendering, automated quality checks, and visual review.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "bookforge" from https://skillstore.io/skills/gongnyang-bookforge.md and its manifest at https://skillstore.io/api/skills/gongnyang-bookforge/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/gongnyang-bookforge.md 서명된 manifest GET /api/skills/gongnyang-bookforge/manifest 서명된 lockfile GET /api/skills/gongnyang-bookforge/lockfile

테스트해 보기

"bookforge" 사용 중입니다. A topic brief for a short Korean guide to spreadsheet workflows.

예상 결과:

Illustrative deliverables: sourced research notes, a chapter outline, Markdown chapters, a practical-style PDF, a QC report, and page previews.

"bookforge" 사용 중입니다. A trusted Korean essay manuscript in DOCX format with chapter headings.

예상 결과:

Illustrative deliverables: normalized chapter files, extracted summaries, an essay-style PDF, and a record of formatting changes.

"bookforge" 사용 중입니다. Trusted research notes, chart data, and a brand color for an industry report.

예상 결과:

Illustrative deliverables: a business-style PDF with sourced figures, numbered contents, bookmarks, and diagrams checked for readable labels and contrast.

보안 감사

높은 위험

v1 • 2026. 10. 6. 버전별 보고서 열기

Most supplied alerts are benign documentation, integrity hashes, regex matches, or expected local build operations. Unconfined paths and active-content rendering expose untrusted projects; no evidence found of deliberate exfiltration or audit-directed prompt injection in reviewed material. The oversized executable bundle and 791 omitted matches remain review gaps, so these verdicts do not establish complete publication safety. Static review was capped at 400/1191 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

스캔된 파일

22,454

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (3)

높음

scripts/build_html.py:31-32 scripts/build_html.py:808-822 scripts/print_pdf.mjs:18-22 scripts/render_diagrams.mjs:1355-1390 scripts/fo2text.mjs:24-38 scripts/build.py:25-27

Active Document Content Executes Before Quality Checks

Raw Markdown HTML and unescaped callouts enter the Chromium PDF renderer. Authored SVGs enter page.setContent after only narrow external-reference checks. Hostile markup can run browser scripts or make outbound and internal-network requests before QC rejects the project.

The inspected paths embed input markup in browsers without disabling JavaScript or denying network requests. This confirms exposure, not malicious exploitation or host-level execution.

중간

scripts/build.py:109-119 scripts/build_html.py:1009-1010 scripts/md2typ.py:302-303

Unconfined Outline Paths Can Disclose Local Text

Both build engines join chapter file values without rejecting absolute paths or checking resolved containment. A hostile outline can place readable outside-project text into the book. Sharing that output can unintentionally disclose local information.

The chapter file value reaches Python read_text without a containment check in both engines. Typst's compile root cannot constrain those earlier reads.

낮음

vendor/antv-ssr.bundle.mjs:1

Unscanned file (too_large) — manual review required

[unscanned: too_large]

The 2.47 MB executable bundle is imported during diagram rendering but exceeded the scanner limit. Partial inspection cannot establish complete provenance or safety.

기능 검토 항목 (6)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/build_html.py:854

Path traversal sequence

if book_dir and src.endswith(".svg") and src.startswith("../assets/"):

A chapter-controlled SVG suffix is joined under assets without resolving and enforcing containment. Parent segments or symlinks can read and inline SVGs outside the project.

높음

scripts/build_html.py:855

Path traversal sequence

svg_path = book_dir / "assets" / src[len("../assets/"):]

A chapter-controlled SVG suffix is joined under assets without resolving and enforcing containment. Parent segments or symlinks can read and inline SVGs outside the project.

높음

scripts/qc_gate.py:345

Path traversal sequence

name = ref[len("../assets/"):]

The SVG reference suffix reaches read_text after an unconstrained assets path join. A hostile reference can make QC read an outside SVG.

높음

scripts/qc_gate.py:388

Path traversal sequence

stem = ref[len("../assets/"):-len(".svg")]

An unchecked reference stem forms the labels.json path before a local file read. Parent segments or symlinks can escape assets and read unrelated JSON.

높음

scripts/qc_gate.py:432

Path traversal sequence

stem = ref[len("../assets/"):-len(".svg")]

The unchecked reference stem forms SVG, label, sidecar, and metric paths. QC reads those files without checking resolved project containment.

중간

scripts/render_diagrams.mjs:175

Synchronous file operations

const tokens = JSON.parse(readFileSync(tokensPath, "utf8"));

The style token path is derived from the style argument without enforcing the styles directory. A hostile book style can select a tokens.json outside that directory.

위험 요인

📁 파일 시스템 접근 (50)

assets/fonts/LICENSES.md:3 modes/topic.md:38 modes/topic.md:45 README.en.md:92 README.en.md:93 README.en.md:94 README.en.md:92 README.en.md:93 README.en.md:94 README.en.md:92 README.en.md:93 README.en.md:94 README.md:92 README.md:93 README.md:94 README.md:92 README.md:93 README.md:94 README.md:92 README.md:93 README.md:94 references/diagrams.md:18 references/diagrams.md:42 references/diagrams.md:42 references/extending.md:104 references/extending.md:106 references/extending.md:107 references/extending.md:111 references/extending.md:112 scripts/build_html.py:854 scripts/build_html.py:855 scripts/build_html.py:1489 scripts/build.py:99 scripts/build.py:94 scripts/build.py:95 scripts/fetch_fonts.py:14 scripts/fetch_fonts.py:33 scripts/fo2text.mjs:8 scripts/fo2text.mjs:250 scripts/fo2text.mjs:251 scripts/fo2text.mjs:255 scripts/fo2text.mjs:235 scripts/fo2text.mjs:174 scripts/fo2text.mjs:210 scripts/g16_tokens.py:1601 scripts/g16_tokens.py:1078 scripts/g16_tokens.py:1086 scripts/g16_tokens.py:1226 scripts/g16_tokens.py:1234 scripts/g16_tokens.py:1236

🌐 네트워크 접근 (50)

⚙️ 외부 명령어 (50)

🔑 환경 변수 (6)

scripts/build_html.py:1232 scripts/build.py:73 tests/mutations/run_mutations.py:795 tests/test_wcag_parity.py:46 tests/test_wcag_parity.py:46 tests/test_wcag_parity.py:70

⚡ 스크립트 포함 (13)

scripts/build.py:131 scripts/fo2text.mjs:235 scripts/fo2text.mjs:237 scripts/fo2text.mjs:238 scripts/render_diagrams.mjs:485 scripts/render_diagrams.mjs:488 scripts/render_diagrams.mjs:489 scripts/render_diagrams.mjs:728 scripts/render_diagrams.mjs:773 SKILL.md:20 templates/base.typ:238 tests/mutations/run_mutations.py:171-173 tests/mutations/run_mutations.py:174-176

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/gongnyang-bookforge/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/gongnyang-bookforge/security.svg)](https://skillstore.io/skills/gongnyang-bookforge?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/gongnyang-bookforge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/gongnyang-bookforge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/gongnyang-bookforge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

gongnyang. (2026). bookforge security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/gongnyang-bookforge/audits/1

BibTeX 인용

@techreport{gongnyang-gongnyang-bookforge-2026,
  author = {gongnyang},
  title = {bookforge security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/gongnyang-bookforge/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bookforge security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "gongnyang"
date-released: "2026-10-06"
url: "https://skillstore.io/skills/gongnyang-bookforge/audits/1"
identifiers:
  - type: other
    value: "skillstore:gongnyang-bookforge:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Publish a Practical Korean Guide

Develop a sourced topic into chapters, tips, tables, and a consistently formatted PDF using the practical style.

Typeset an Existing Manuscript

Preserve manuscript meaning while organizing chapters, extracting summaries, and applying essay or academic layouts.

Prepare a Branded Research Report

Format trusted research, figures, and citations into an insight or business PDF with a brand color and checked pagination.

이 프롬프트를 사용해 보세요

Beginner: Start from a Topic

Create a short Korean ebook about [topic] for [audience] using the practical style. Verify factual sources, build the book, run QC, and inspect representative pages.

Intermediate: Format a Manuscript

Typeset my trusted [Markdown, text, or DOCX] manuscript as a Korean essay ebook. Preserve its meaning, report normalization changes, and complete QC and visual inspection.

Advanced: Produce a Branded Report

Create a Korean business report from my trusted research files for [audience], using brand color [hex]. Preserve citations and add supported vector charts. Report build or QC failures before delivery.

Expert: Build a Diagram-Rich Book

Create a standard-length Korean technical ebook from my trusted outline and chapters. Choose diagram types by purpose and retain captions and sources. Use AntV sidecars or authored SVGs, verify labels and contrast, then run QC and inspect page previews.

모범 사례

Keep book projects outside the skill repository and provide only trusted manuscripts, metadata, and SVG assets.
Choose a style for the audience and supply verified sources, image permissions, and substantive content for the selected length.
Run the build and QC gates, then inspect the cover, contents, chapter opener, and body pages before distributing the PDF.

피하기

Do not process unknown projects or active HTML and SVG inputs with unrestricted browser or filesystem access.
Do not add filler chapters, excessive spacing, or forced page breaks merely to reach a page target.
Do not weaken gates to hide book defects or treat an uninspected draft as final output.

자주 묻는 질문

Can I start with only a topic?

Yes. Topic mode guides research, outline planning, and chapter writing before typesetting and quality checks.

Which manuscript formats are supported?

Markdown, text, and DOCX are supported inputs. DOCX requires python-docx; convert HWP to a supported format first.

Which design styles are available?

The six styles are practical, insight, academic, essay, business, and magazine. Their trim sizes and layout engines differ.

Does every style require Chromium?

No. Practical, academic, essay, and business use Typst. Insight, magazine, and diagram rendering require Playwright and Chromium.

Does passing QC guarantee publication readiness?

No. QC checks defined layout and consistency rules. You must still inspect pages and verify facts, rights, and publication requirements.

Can it safely render an unknown book project?

Not currently. The audit identified unconfined paths and active-content risks. Use trusted inputs and isolated rendering until those issues are addressed.