Security audit

多Agent协作小说创作系统

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language novel-writing workflow skill that creates structured fiction drafts and project files, with no evidence of hidden code execution, credential access, network use, or system persistence.

Install this if you want a Chinese web-novel planning and drafting workflow. Use step-by-step mode for more control, especially because the default mode may proceed through the full writing process automatically after an idea is provided.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger scope is overly broad and explicitly captures vague everyday requests like '我有个想法想写下来' and '帮我构思一个故事', which can cause the skill to activate when the user did not actually request this specialized workflow. That increases the chance of unintended routing, hidden context injection, and user intent override, especially because the skill then steers the interaction into a prescriptive multi-agent process.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation is entirely in Chinese and presents Chinese-language operation as the default without indicating that users may choose another language. While not a direct security exploit, this can create consent and usability issues by steering users into a language context they did not request, which may cause misunderstanding of outputs or hidden assumptions in workflow activation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match routine brainstorming and general writing requests, which can cause the skill to activate when the user did not explicitly ask for a multi-agent novel-writing workflow. This increases the chance of unintended scope capture, surprising behavior, and inappropriate routing of ordinary requests into a specialized system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill hard-codes a Chinese-language and China-platform context, including platform-specific defaults and style assumptions, without asking the user for language or locale preference. This can mis-handle user intent, produce inappropriate outputs for non-Chinese users, and silently route content into culturally or commercially mismatched constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The entire skill content, including headings and style guidance, is written in Chinese and specifies adaptation for '番茄小说', which implies a fixed language/locale expectation. There is no indication that users may choose another language or that the Chinese-only constraint is explicitly justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file presents all guidance exclusively in Chinese without indicating that the language is optional, selectable, or justified as region-specific, which can violate a policy requiring user language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The heading and subtitle state that these are standard output templates for all agents, and the templates are written entirely in Chinese. This imposes a specific language requirement on agent outputs without indicating user choice, opt-in, or a justified region-specific scope, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire workflow, role names, and user-facing instructions are written only in Chinese, with no indication that the user may choose another language or that the skill is intentionally limited to Chinese-language use. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains natural-language instructions entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.