文游剧本生成系统

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:09 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent text-game and Word-export purpose, but its required export command can turn a user-controlled title or generated content into shell command execution and writes to the Desktop without explicit opt-in.

Install only after the export workflow is fixed to avoid shell interpolation, pass arguments and document content through a shell-free process API, sanitize filenames, show the exact output path, and ask before writing to the Desktop. Use a pinned dependency or locked environment for python-docx.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:56

Finding

Shell Command Injection Through User-Controlled Title and Heredoc Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:56-63
Vulnerability Type: Shell command injection
Risk Level: High
Category: T09: Insecure Skill Coding Practices

Vulnerable Code

bash

python "SKILL_DIR/scripts/export_word.py" "$HOME/Desktop/文字游戏剧本_<标题>.docx" "<标题>" - &lt;&lt;EOF
<这里放生成的Markdown格式剧本内容>
EOF

Technical Analysis

The skill instructs the agent to interpolate a user-influenced title and generated Markdown content directly into a shell command. Although the title arguments are shown inside double quotes, shell constructs such as command substitution remain active inside double-quoted strings when the final command text is interpreted by a shell.

The unquoted heredoc delimiter creates an additional injection surface. A generated script containing a line that exactly matches EOF can terminate the heredoc prematurely. Any subsequent lines can then be parsed as shell commands rather than document content.

The Python exporter does not independently execute shell commands. The vulnerability exists in the documented invocation mechanism required by the skill.

Attack Path

1. An attacker asks the agent to generate a game using a malicious title containing shell syntax, such as a command substitution expression.
2. Alternatively, the attacker requests generated Markdown containing a standalone EOF line followed by shell commands.
3. The agent follows SKILL.md and substitutes the title and generated content into the documented shell command.
4. The command is submitted to a shell.
5. The shell evaluates the injected command substitution or treats content after the premature heredoc terminator as commands.
6. The injected commands execute with the permissions of the user or agent process running the skill.

Impact Assessment

Successful exploitation can provide arbitrary command execution under the invoking account. The attacker could read files available to tha ...[truncated 338 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell command strings using user-controlled or generated values.
• Invoke scripts/export_word.py through a process API that accepts an argument array and does not enable shell interpretation.
• Pass the document body through the subprocess standard-input API rather than embedding it in a heredoc.
• Derive the output filename from a sanitized title using a strict allowlist of safe characters.
• Remove path separators, control characters, quotes, shell metacharacters, and traversal sequences from generated filenames.
• Resolve and validate the output path before writing, ensuring it remains inside the intended export directory.
• If a shell script is unavoidable, use a randomly generated quoted heredoc delimiter and robust argument escaping; however, a shell-free subprocess call is strongly preferred.
• Add regression tests using titles and content containing quotes, command substitutions, newlines, EOF, path traversal sequences, and shell metacharacters.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:102

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:102-106
Vulnerability Type: Unpinned dependency and non-reproducible package installation
Risk Level: Medium
Category: T08: Insecure Dependencies

Vulnerable Code

bash

pip install python-docx

The exporter also directs users toward the same unpinned installation command when the import fails:

Additional Location: scripts/export_word.py:14-19

python

try:
    from docx import Document
    from docx.shared import Pt
    from docx.enum.text import WD_PARAGRAPH_ALIGNMENT
except ImportError:
    print("错误: 需要安装 python-docx 库")
    print("请运行: pip install python-docx")
    sys.exit(1)

Technical Analysis

The project instructs users to install python-docx without specifying a reviewed version, hashes, a lockfile, or an explicitly trusted package source. Consequently, package resolution depends on the state and configuration of the package index at installation time.

This creates a non-reproducible dependency chain. A future compromised release, unsafe transitive dependency, maliciously configured package index, or incompatible update could be installed without a corresponding change to the audited project.

The available code does not demonstrate active dependency confusion or a malicious package. The risk arises from the unsafe and unpinned installation process.

Attack Path

1. The exporter fails to import the docx package, or the user follows the dependency instructions in SKILL.md.
2. The user runs pip install python-docx.
3. pip resolves the current package version and transitive dependencies from the environment's configured indexes.
4. If the selected source or resolved release has been compromised, malicious installation or runtime code may execute.
5. That code runs with the permissions of the account performing the installation or invoking the exporter.

Impact Assessment

A c ...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

• Pin python-docx to a reviewed, compatible version.
• Maintain a lockfile that records all direct and transitive dependency versions.
• Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file.
• Install packages from an explicitly trusted package index.
• Use an isolated virtual environment and avoid privileged or system-wide package installation.
• Add automated dependency vulnerability and update monitoring.
• Review new dependency versions before updating the lockfile.
• Replace the runtime installation instruction with a reproducible setup command based on the project's locked dependency manifest.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个可基于主题生成文字游戏剧本、提供多种内置模板，并支持游玩/创作的完整技能；而实际代码块只是一个Word导出工具。它接收输出路径、标题和内容，读取文本后生成.docx文件，添加标题和时间并做基础段落格式化。代码没有任何剧本生成、模板选择、游戏逻辑或桌面路径处理功能。因此描述与实际行为存在明显不匹配，实际能力远小于且不同于声明的主要用途。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill instructs reading local reference files and invoking a local export script, but it declares no explicit tool scope or permissions. That creates an authorization gap where the runtime may permit file access beyond what reviewers or users would expect, reducing transparency and increasing the chance of unintended local file access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to activate on common conversation about games or writing, which can cause the skill to run unexpectedly. In this skill, unexpected activation is more concerning because the workflow includes local file export, so accidental invocation could lead to unintended file creation on the user's system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates exporting a Word document to the user's desktop but provides no warning or consent flow for writing to the local filesystem. Silent or assumed file creation on a prominent user directory can surprise users, clutter the system, and normalize unsafe local-write behavior that could be abused if the content or filename is manipulated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Making desktop export mandatory in the output requirements removes user choice and still omits any warning about filesystem impact. Because the skill is creative and conversational in nature, mandatory local writes are not strictly necessary for core functionality, so forcing them increases risk relative to the task context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document title and all operational instructions are written entirely in Chinese and present the templates as the required response format, with no indication that users may choose another language. This creates a language/locale constraint that is not documented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.