Security audit

Story Setup

Security checks across malware telemetry and agentic risk

Overview

This setup skill is not malicious, but it installs lasting local hooks, OpenCode plugin controls, and browser-session automation shortcuts that deserve user review.

Install only if you want this project to have persistent writing-workflow hooks and OpenCode/Claude automation. Review the generated settings, plugin, command files, and git hook first, and be especially careful with browser CDP features because they may act through an already logged-in Chrome session.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill describes extensive filesystem and hook deployment behavior, including reading environment-adjacent project state and installing executable scripts, yet it does not declare permissions. Undeclared capabilities reduce user visibility and consent, making it easier for a skill to perform impactful actions that users and tooling may not anticipate.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is setup/deployment, but the documented behavior goes far beyond installation by adding persistent hooks that intercept writes, inspect git state, inject session context, and enforce workflow constraints. This mismatch is dangerous because users may authorize a one-time setup action without understanding they are installing ongoing monitoring and control logic into future sessions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Granting `bash: allow` to a research-focused subagent violates least privilege and materially increases the attack surface. Because this agent consumes potentially adversarial web content and user-supplied query/path parameters, shell access could be abused to run unintended commands, probe the host, or manipulate files beyond the research task.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The command file belongs to the story-setup skill but its frontmatter and body describe and invoke a different skill, story-deslop. This can cause users or the agent to execute unintended functionality, creating a skill-routing/integrity problem where a setup command silently triggers text-rewriting behavior instead of infrastructure deployment.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The command file’s declared purpose is long-form novel analysis, which does not match the advertised skill metadata for project setup and infrastructure deployment. This kind of capability mismatch can misroute user intent, cause the wrong skill to be invoked, and undermine trust and security boundaries by exposing unrelated behaviors under a trusted setup command.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file belongs to the 'story-setup' skill, whose declared purpose is deploying local writing-project infrastructure, but the command instead invokes a different capability ('story-long-scan') for market ranking analysis. This mismatch can cause users or orchestrators to trigger behavior outside the advertised scope, undermining trust boundaries and enabling unexpected actions through mislabeled skill content.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The file belongs to a skill whose manifest says it should deploy writing-project infrastructure, but this command instead routes the agent into long-form writing assistance. That mismatch can cause unintended capability activation, confusing user intent and potentially bypassing expected safety boundaries around when authoring behaviors should be invoked.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The command file introduces and invokes a story-review capability, which is outside the declared purpose of the story-setup skill as infrastructure deployment for writing projects. This kind of scope mismatch is dangerous because it can cause the agent to execute unintended capabilities under a trusted skill name, weakening user consent and security boundaries around what the skill is expected to do.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The command file advertises and invokes a short-story analysis skill, while the manifest says this package is for deploying writing project infrastructure into the user's directory. This scope mismatch can cause users or orchestrators to invoke a capability they did not intend, weakening trust boundaries and increasing the chance that unrelated or more privileged setup actions are triggered under an analysis-themed entry point.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The command file’s behavior does not match the declared purpose of the skill: instead of deploying writing-project infrastructure, it invokes a short-story ranking scan capability. This kind of scope drift is dangerous because it can cause the agent to execute unexpected workflows under a trusted skill name, undermining user consent, policy review, and least-privilege assumptions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file content describes and invokes a different skill ('story-short-write') than the declared skill metadata ('story-setup'). This kind of skill-identity mismatch can cause the wrong capability to be triggered, undermining user intent and any trust, routing, or review assumptions tied to the declared setup skill.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The inline instruction explicitly tells the agent to use a different skill than the one declared by the manifest. This creates confused-deputy behavior where a benign-looking package can redirect execution into another skill, bypassing user expectations and weakening security review boundaries.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file’s content describes a generic routing entrypoint for a story-writing tool, while the manifest says this skill is for deploying infrastructure into a user project. This mismatch can cause the agent to invoke behavior outside the user’s expected scope, increasing the risk of incorrect tool selection, unintended actions, or bypass of safer setup-specific logic.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The inline instruction explicitly tells the agent to use the story skill for automatic routing, which contradicts the manifest’s stated setup/deployment intent. In an agentic system, this kind of contradictory instruction can redirect execution flow and cause the agent to perform unintended operations under the wrong trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The plugin reads project writing context and Git change state, then injects that information into session compaction context. This expands the skill from setup/deployment into ongoing project-state collection, which can expose sensitive repository metadata or manuscript context to later model processing without clear user consent.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The plugin enforces content-creation policy by blocking prose writes unless certain outline files exist, which is materially different from the declared infrastructure-setup purpose. Runtime enforcement over user file operations can manipulate or constrain user behavior and may prevent legitimate edits, making the skill more powerful than advertised.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The plugin hooks `write`, `edit`, and `bash` execution before runtime and can abort operations by throwing errors. A skill presented as one-time environment setup but actually intercepting broad tool execution creates a significant trust mismatch and grants persistent control over future agent actions, including command-line workflows.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The agent is declared read-only and explicitly disallows Bash, yet the instructions require executing `git rev-parse --show-toplevel` to determine the project root. This creates an internal policy contradiction that can cause the runtime, orchestrator, or future maintainers to permit shell execution despite the declared safety boundary, weakening tool-isolation guarantees.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The agent is required to modify files outside the primary writing output by automatically updating `追踪/上下文.md` and potentially creating a `追踪/` directory. That expands the side-effect scope from content generation into project state management, which can surprise users, overwrite existing tracking data, or create persistent artifacts without explicit consent.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The document says the agent does not own broader project-consistency responsibilities, yet later mandates context-file management. This boundary mismatch is dangerous because callers may trust the declared scope while the agent still performs cross-file state changes, increasing the risk of unintended modifications and weak oversight.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases include broad natural-language requests such as '帮我搭一下环境' and '配置写作项目', which can match ordinary user intent without clearly signaling that executable hooks, agents, and repo modifications will be installed. Overbroad triggering increases the chance of accidental activation of a high-impact setup skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The agent explicitly instructs itself to use Write/Edit to directly modify files whenever a file path is provided, without requiring an explicit user confirmation step at the moment of mutation. In a skill that is invoked as a subagent and can receive file paths from higher-level prompts, this increases the risk of unintended or over-broad repository changes, especially because the user may not see the exact write set before the action occurs.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill mandates automatic post-task updates to tracking files and even creation of the 追踪 directory and 上下文.md if absent, again without a user-facing approval step. This is more dangerous than a normal content-writing instruction because it causes side-effecting writes outside the primary output file, making repository state changes less predictable and easier to abuse for unwanted persistence or metadata tampering.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The command text is a generic trigger to use a browser automation skill for broad tasks like data scraping or browser control, without constraining scope, authorization, or target sensitivity. This can cause the agent to invoke powerful browser-control capabilities for ordinary user phrasing, increasing the risk of misuse, unintended access, or overbroad actions against authenticated sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description explicitly highlights reusing an existing Chrome login state via CDP, which enables the skill to act with the user's authenticated identity across websites. Without prominent warnings, consent checks, or restrictions, this creates substantial risk of privacy violations, unauthorized data access, and unintended account-impacting actions such as submissions, purchases, or settings changes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: references/opencode/plugin.ts:16