Novel Writer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 1.1.0

Overview

This is a Chinese novel-writing helper with local templates, references, and simple user-run scripts; I found no hidden network access, credential handling, persistence, or destructive behavior.

Installers should understand this is primarily a Chinese fiction-writing prompt/reference package with small local utilities. Run the scripts only on writing files you intend to process, use --watch only when you want a foreground live counter, and invoke the skill explicitly if broad phrases like “续写” or “润色” could conflict with other writing workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description promises a comprehensive AI novel creation assistant with multiple writing-support capabilities across the full writing workflow. The actual code chunk only implements one limited subset: a basic logic-consistency check over supplied text files using regex-style heuristics. That subset loosely aligns with the declared mention of ‘逻辑一致性检查’, but the overall declared purpose materially overstates the implemented functionality. There is no evidence of generation, continuation, polishing, templates,素材库, or字数统计. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad, end-to-end 'novel AI writing assistant' with multiple writing-support capabilities. The supplied code chunk only generates a markdown-style outline scaffold from a few user inputs and can save it locally. There is no AI generation beyond template filling, no chapter drafting, no continuation, no polishing, no consistency analysis, no素材库, and no字数统计工具. While outline generation is consistent with part of the description, the actual code materially underdelivers relative to the declared primary purpose and advertised feature set, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad 'AI novel creation assistant' covering the full writing workflow from inspiration to finished manuscript, including generation, continuation, polishing, consistency checks, templates, resource libraries, and word counting. The supplied code only implements a single CLI validator for outline completeness. It reads one markdown file from disk and checks for the presence of specific fields and keywords, then prints recommendations. This is materially narrower than the declared purpose and lacks the central claimed AI authoring capabilities. While outline validation is loosely related to writing support, the description significantly overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents the skill as a full-featured AI novel creation assistant covering brainstorming, outlining, drafting, rewriting, polishing, and consistency analysis. The supplied code only implements a text statistics tool that reads local .txt files and reports counts and simple estimates. While '字数统计工具' is mentioned in the description, it is only one small sub-feature of the claimed product. The actual code does not implement the primary declared capabilities, so the description materially overstates what the code does.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The listed trigger phrases are very broad and generic, such as common writing-related terms that can easily appear in ordinary conversation. This can cause the skill to activate unintentionally, leading to unsolicited use of the skill, prompt/context hijacking of normal chats, or accidental handling of user content under the skill's instruction set.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Repeating the same vague short-form public triggers reinforces an unsafe activation design: one-word commands like '续写' or '润色' are highly likely to overlap with normal user requests outside the context of intentionally invoking this skill. In a writing assistant context, these words are especially common, which increases the chance of accidental activation and unintended routing of sensitive user text into the skill flow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases for story ideation are very broad and map to common, ordinary user requests such as '写小说' or '创作故事'. In a skill-routing system, this can cause the skill to activate unexpectedly on general conversation, increasing the chance of unintended prompt/context capture and behavior hijacking by overbroad invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Continuation triggers like '续写', '继续写', and especially '接下来呢' are ambiguous and commonly appear in normal dialogue. This makes accidental invocation particularly likely during unrelated chats or when users ask ordinary follow-up questions, which can misroute agent behavior and expose prior context to the skill unnecessarily.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Polishing triggers such as '润色', '修改文章', and '改写' are generic editing requests that overlap heavily with standard assistant capabilities. Without scope restrictions, the skill may intercept broad writing tasks unintentionally, creating unnecessary privilege/behavior expansion and making prompt-routing less predictable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The summary trigger list repeats several vague phrases without clarifying activation boundaries, reinforcing unsafe routing behavior across the whole skill. Because these triggers are presented as the final quick-start interface, they increase the operational likelihood of accidental activation and ambiguous skill selection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Overly broad trigger phrases can cause the skill to activate on ordinary writing-related prompts that were not intended to invoke it. In an agent ecosystem, unintended activation can lead to unnecessary file access, incorrect workflow routing, or accidental processing of sensitive user content under this skill's instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Ambiguous continuation triggers like generic requests to 'continue writing' may collide with many normal assistant interactions. That increases the chance of accidental skill invocation, which can redirect content generation or trigger associated tooling in contexts where the user did not expect specialized processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad editing triggers overlap heavily with normal requests for revision and rewriting, making accidental activation likely. In systems where skills carry specialized prompts or tool access, this can expose user text to unintended processing paths and make behavior less predictable or controllable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains a full skill/example artifact exclusively in Chinese, including headings, instructions, and the usage note, with no indication that the user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents the checklist entirely in Chinese and states it is for use by the novel-writer skill, but it does not indicate that Chinese output is optional or limited to a China-specific use case. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

该 markdown 文件的标题和用途说明均明确为中文，但没有说明这是仅面向中文写作场景的素材库，也没有提供语言选择或用户 opt-in。按规则，强制特定语言而无选择或正当说明，属于自然语言层面的语言/区域策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains natural-language guidance that explicitly requires adherence to Chinese punctuation standards. Under the policy, forcing a specific language/locale without user opt-in can be a violation unless the locale restriction is clearly documented and justified; this reference guide does not state that limitation as an explicit opt-in or region-specific requirement.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/generate_outline.py (reported line 119)May include surrounding context.

python

---
*由 Novel AI Writer 辅助生成*
*生成时间：{__import__('datetime').datetime.now().strftime('%Y-%m-%d %H:%M')}*
"""
    
    return outline

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The consistency-check triggers are somewhat ambiguous and lack firm activation boundaries, which can still cause unintended invocation. The impact is lower than the broader writing/editing triggers because the scope is narrower, but it may still route documents into analysis workflows without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This sample forces a specific language for the skill content and output format, and the file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file consists entirely of Chinese-language instructional content and examples, with no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy rule for language or locale constraints, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire template, including the title and all instructional text, is written in Chinese and presents the skill content as Chinese by default. Under the policy rules, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown skill reference forces a specific language/locale for all users through its natural-language content. The stated policy flags language or locale constraints when the skill does not provide user opt-in or explain that the restriction is region-specific and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document is entirely written in Chinese and states it is for use by the novel-writer skill, which may impose a specific language/locale on users without any opt-in or alternative language choice. This matches the policy concern for language or locale constraints that are not explicitly optional or justified.

Content

No source excerpt is available for this finding.