lobster-novel

• Outcome: Review
• Latest audit: May 28, 2026 · 11:13 AM UTC
• Version: 1.4.0

Overview

This is a coherent novel-writing toolkit, but it sends manuscript/project content to third-party LLM APIs in several paths that are not fully disclosed or gated.

Install only if you are comfortable with unpublished manuscript, world-building, character notes, chapter plans, and rewrite inputs being sent to third-party LLM providers. Use a dedicated project directory, dedicated API keys, and avoid running the DeepSeek helper scripts or lesson sync features unless you have reviewed their targets and environment variables.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""调用 bridge_to_self_improving 同步到 ~/self-improving/"""
    if BRIDGE_SCRIPT.exists():
        import subprocess
        result = subprocess.run(
            [sys.executable, str(BRIDGE_SCRIPT)],
            capture_output=True, text=True, timeout=30)
        print(result.stdout)

• Confidence: 93% confidence
• Finding: The code launches an external Python script via subprocess, which is a real code-execution sink. In this file, the executed path is not hardcoded to a trusted location but derived from configurable state, so invoking sync() can run attacker-controlled code if the environment or repository layout is manipulated.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# 确保 review 目录可导入同级模块
_review_dir = Path(__file__).parent
if str(_review_dir) not in __import__('sys').path:
    __import__('sys').path.insert(0, str(_review_dir))

# ═══════════════════════════════════════════════════════════════
#  AI味检测模式库（与 aigc_detect.py 同步扩展）

• Confidence: 79% confidence
• Finding: The code prepends the script's directory to sys.path at runtime, which changes Python's module resolution order for subsequent imports. In this file, that affects later imports such as 'strand_balance' and can enable local module shadowing if an attacker can place a malicious file in the review directory, causing unintended code execution when the import occurs.

Tainted flow: 'BRIDGE_SCRIPT' from os.environ.get (line 22, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

"""调用 bridge_to_self_improving 同步到 ~/self-improving/"""
    if BRIDGE_SCRIPT.exists():
        import subprocess
        result = subprocess.run(
            [sys.executable, str(BRIDGE_SCRIPT)],
            capture_output=True, text=True, timeout=30)
        print(result.stdout)

• Confidence: 98% confidence
• Finding: BRIDGE_SCRIPT is built from LOBSTER_EVOLVER, which comes from os.environ, and that tainted path flows directly into subprocess.run. An attacker who can influence the environment can redirect execution to an arbitrary Python file, resulting in unauthorized code execution under the privileges of the current process.

Tainted flow: 'req' from os.environ.get (line 33, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = urllib.request.Request(
                DEEPSEEK_URL, data=payload,
                headers={"Content-Type": "application/json", "Authorization": f"Bearer {DEEPSEEK_KEY}"})
            with urllib.request.urlopen(req, timeout=300) as resp:
                data = json.loads(resp.read().decode("utf-8"))
            return data["choices"][0]["message"]["content"]
        except Exception as e:

• Confidence: 97% confidence
• Finding: The script reads an API credential from the environment and uses it to authenticate outbound requests to a third-party LLM service. In this skill context, project content, prompts, and generated material are transmitted externally without any consent gate, data-minimization control, or clear disclosure in the module description, creating a real data-exfiltration and secret-handling risk.

Tainted flow: 'QC_SCRIPT' from os.environ.get (line 15, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def run_qc(path):
    import subprocess
    r = subprocess.run(["python3", str(QC_SCRIPT), str(path), "--json"],
                       capture_output=True, text=True, timeout=30)
    if r.returncode == 0 and r.stdout.strip():
        return json.loads(r.stdout)

• Confidence: 86% confidence
• Finding: QC_SCRIPT is derived from NOVEL_DIR, which itself comes from an environment variable, so an attacker who can influence the environment can redirect execution to an arbitrary Python file. Because the code executes that path with python3, this becomes arbitrary code execution in the context of the running process.

Tainted flow: 'QC_SCRIPT' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def run_qc(path):
    import subprocess
    r = subprocess.run(["python3", str(QC_SCRIPT), str(path), "--json"],
                       capture_output=True, text=True, timeout=30)
    if r.returncode == 0 and r.stdout.strip():
        return json.loads(r.stdout)

• Confidence: 91% confidence
• Finding: QC_SCRIPT is derived from NOVEL_DIR, which comes from the NOVEL_DIR environment variable, and is then executed as Python code. If an attacker can influence NOVEL_DIR or the filesystem layout, they can point the program at a malicious review/quality_check.py and gain arbitrary code execution when run_qc is called.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module sends prompt content to an external LLM service, including chapter summaries, world rules, and character data, but the skill metadata provides no declared justification or user-visible consent flow for network access. In an agent setting, undisclosed outbound transmission of potentially sensitive project content is a real security and privacy risk even if the functionality is product-motivated.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The code automatically reads DEEPSEEK_API_KEY from environment variables without any manifest-scoped secret declaration or clear boundary on when secret access is needed. This increases the attack surface because skills should not implicitly harvest ambient credentials from the runtime unless that access is explicitly authorized and expected.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring claims synchronization to a specific trusted destination, but the implementation actually executes a script path derived from an environment variable. This mismatch can mislead reviewers and operators into trusting behavior that is broader than advertised, increasing the chance that dangerous execution paths go unnoticed and are abused.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The docstring describes a local content-generation workflow, but the implementation also sends story, character, and world data to an external LLM API. That mismatch is security-relevant because it conceals network data transfer from reviewers and operators, undermining informed consent and safe deployment decisions.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The LLM mode transmits the input text to an external API, which can expose sensitive manuscript content, personal data, or proprietary material if users do not realize the rewrite path is remote. In this skill's context, the feature is optional and functionally related, but the absence of manifest-scoped justification or explicit privacy controls makes the data-transfer behavior risky.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The script advertises a SceneItemVerifier pre-check but does not enforce its outcome before generating and saving content. If the verifier is intended as a safety or policy gate, this creates a fail-open condition where unverified or policy-violating content can still be produced and persisted.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes automatic chapter writing via the SenseNova API but does not warn users that chapter drafts, context, continuity data, and other novel content may be transmitted to a third-party service. In a writing pipeline that emphasizes continuity, memory, and RAG, this omission can mislead users about data handling and create privacy, confidentiality, or intellectual-property exposure.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly states it is designed for long-form Chinese fiction, which can steer agent behavior toward a specific output language without confirming user preference. In an agent setting, this can cause unwanted language switching, poor UX, and failure to satisfy user intent when the user expects another language.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script transmits rich local content to a third-party LLM service, including story bible data, previous chapter text, and verifier-produced prompt content, without any consent gate, minimization, or redaction. In this skill context, the transmitted material is not obviously secret, but external transmission of potentially proprietary project content can still create confidentiality and data-governance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends user-provided chapter content, context, and review text to an external API endpoint operated by SenseNova. There is no consent flow, disclosure, redaction, or data classification check in this file, so potentially sensitive manuscript or embedded personal/confidential data may be transmitted off-system unexpectedly.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code sends project context, character data, and chapter-planning content to an external LLM API without any explicit notice, consent gate, or data-minimization control in this file. In a writing skill, that can expose unpublished manuscript content or sensitive notes to third-party services, creating a real confidentiality risk even though the domain is creative writing rather than secrets handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The revision path sends up to 5000 characters of full chapter text plus issue descriptions to an external model, again without any explicit privacy disclosure or confirmation. Because this may include unpublished creative work, proprietary world-building, or embedded personal content, the external transmission is a genuine data exposure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The external API request transmits chapter summaries, world-setting data, and selected character details to a third-party model without any in-code warning, consent prompt, or privacy notice. If the project content is confidential, proprietary, or personal, this can lead to unintended data disclosure and policy noncompliance.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script reads an API credential from the environment and transmits large prompt contents to an external LLM service without any disclosure, consent flow, or data-classification check. In environments where project content may be sensitive, this can cause unintended data leakage to a third party even though the behavior is part of the feature.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends up to 6000 characters of the user's text plus matched excerpts to a third-party API without any explicit warning at the point of use. That creates a privacy and compliance risk because users may assume a local rewrite tool while their content is actually being transmitted off-host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes project files such as bible.json and generated plan outputs directly into the project directory without any confirmation, backup, or safety check. In an automation or agent context, this can silently overwrite existing user work or trusted project state, causing data loss or corruption even if the code is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends prompts and project-derived content to the external DeepSeek API, and later includes volume summaries and other generated material derived from local project files in those requests. Without explicit disclosure, consent, or data-minimization controls, this creates a confidentiality risk because local content may be transmitted to a third-party service unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script transmits locally stored chapter plans, character data, and prior chapter text to a third-party API without any explicit consent gate, warning, or data-minimization control. In contexts where drafts or story bibles are private or commercially sensitive, this can leak proprietary or personal content to an external service.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends locally stored chapter text, plan data, and character data to an external LLM service without any in-code consent, redaction, or classification checks. In a skill context, this can expose proprietary or sensitive content to a third party unexpectedly, especially if the source files contain non-public material.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/reviewer_agent.py:60