T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
novel-bug-checker v2
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a local Chinese novel analysis tool, but it under-discloses its dependency and file-output behavior while unnecessarily loading local .env secrets and optionally invoking another skill's local scripts.
Review before installing. Use an isolated virtual environment, pin and verify dependencies yourself, avoid running the analyzers from directories that contain .env files, and expect log/report/image files to be written. Only use the novel-master v2 commands if you trust that separate skill and are comfortable exposing the referenced local novel state files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/consistency-checker.py:40- Finding
Automatic Loading of Unnecessary Environment Secrets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documented purpose is narrow, but the described/observed behavior includes broader file I/O, report/image generation, logging, and undeclared analytical capabilities. This mismatch is dangerous because users and orchestrators may grant trust or permissions based on the stated purpose while the skill performs materially different operations, undermining least privilege and informed consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file includes collection and emission of network state, process lists, filesystem layout, kernel logs, memory statistics, and thread traces despite the skill being a novel checker. If such functionality is implemented, it could disclose sensitive local environment details, enable fingerprinting of the host, and leak operational data far beyond what is needed for the advertised task.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README describes the skill as a Chinese-novel auditing tool and presents the core positioning entirely as '出版级中文小说' with Chinese-language processing as the default behavior. Because the document does not offer an explicit user choice of output language or clarify that the language restriction is an optional, justified locale constraint, it appears to impose a language/locale requirement without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README states that the tool only depends on lightweight local text analysis (
jieba), but later documents operational reliance onnovel-mastertooling for key v2 checks. This mismatch can mislead users and reviewers about the actual trust model, dependencies, and attack surface, causing them to install or run additional tooling they did not expect. Security-wise, inaccurate dependency disclosure undermines informed consent and hampers risk assessment.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README directs users to run Python scripts from a different skill (
novel-master) to perform version and causal checks. That creates an unnecessary trust boundary crossing for a skill whose stated purpose is novel bug checking, and can lead users to execute unreviewed external code or rely on undeclared components outside this package. In skill ecosystems, cross-skill execution increases supply-chain and confusion risks because users may believe these commands are part of the safe, documented workflow.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The README presents the skill as auditing Chinese novels specifically, and the only listed dependency is a Chinese word segmentation library, which suggests a built-in language constraint. Because the English README does not explicitly frame this as an optional or justified locale-specific mode, it may constitute a language/locale restriction without user choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file instructs users to paste novel text directly and says the AI will automatically analyze it, but it does not warn that uploaded manuscript content may be transmitted to or processed by an AI system. For unpublished or confidential drafts, that omission could affect user privacy or intellectual-property expectations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents file access, dependency installation, and script execution but declares no explicit tool scope or permissions boundaries. In an agent environment, this can lead to over-broad access to local files and environment state beyond what is necessary for novel analysis, increasing the blast radius if the skill is invoked on untrusted inputs or misused by downstream orchestration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as a Chinese novel bug-checking expert, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly reaches into another skill's workspace and state files under ~/.qclaw and invokes that other skill's scripts. Cross-skill access breaks isolation assumptions and can expose private project state, character metadata, or other sensitive files unrelated to the current user request; if normalized, it also enables lateral movement across skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation marker '[激活小说Bug检查技能]' is presented without clear trigger criteria or boundaries, so an agent may apply the skill too broadly whenever it sees vaguely related 'bug' language. In this file, that risk is amplified by mixed examples spanning literary critique and software/API diagnosis, creating ambiguous routing and scope confusion.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The examples expand a narrowly described 'novel bug checker' into generic software/API troubleshooting, which broadens the operational scope beyond the declared purpose. In an agent ecosystem, this can cause the skill to be invoked for unintended technical diagnostics, increasing the chance of unsafe actions, over-collection of technical context, or misuse of the skill outside its trust boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example output states that reports and artifacts were saved or generated, but provides no warning, consent flow, or boundary around file creation. In an agent setting, this can normalize silent persistence of user content and derived files, creating risks around unauthorized writes, data retention, and leakage of sensitive manuscript material.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document's summary claims the skill focuses on novel bug checking, but it also cites API compatibility handling as part of its basis and examples. This intent/content mismatch can mislead orchestrators and users about what the skill is allowed to do, making unsafe cross-domain use more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, language-specific guidance without an explicit opt-in or documented regional justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is supposed to analyze narrative bugs in novels, but this section pivots into software debugging workflows, code inspection, runtime context, and log triage. That scope drift can cause the agent to solicit or process code, logs, and system details unrelated to the declared skill, increasing the chance of unintended handling of sensitive technical data and misuse outside its intended domain.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation explicitly reframes the task from novel analysis to analyzing error messages, code, runtime environments, and reproduction steps. This contradiction can induce the agent to operate as a debugging assistant despite the skill's stated purpose, enabling prompt-scope confusion and accidental collection or analysis of potentially sensitive operational information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese from L001 through L463. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative language option or justification is provided.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire reference document is written in Chinese and provides no indication that language selection is optional or that the skill is limited to Chinese-language use cases. Under the policy criteria, a skill artifact that effectively mandates a specific language without opt-in can be a locale-policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and introductory description are entirely in Chinese and frame the skill content as operating specifically in a Chinese-language context, but the file does not indicate that this language requirement is optional or user-selected. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings and documentation that consistently require Chinese, including the module docstring and all CLI help/output text. The policy scope applies to all file types, and there is no user opt-in or justification for forcing a specific language/locale.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for analyzing novels for logic and consistency issues, which can be implemented entirely from provided text and local processing. Loading .env configuration introduces access to host environment data that is not justified by the stated purpose, especially since the loaded values are not used anywhere in the file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest presents the skill as a novel bug checker that inspects text and provides reports, but the code also persists operational logs to consistency_checker.log and writes report/JSON files to disk. Producing a report may be expected, but unconditional file-based logging and export behavior are additional side effects not communicated in the description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python skill presents its primary docstring, logs, help text, and user-facing messages exclusively in Chinese, with no indication that the user can select another language. That creates a natural-language locale policy issue because the skill imposes a specific language by default rather than offering language choice or documenting a justified regional constraint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a text-analysis skill for checking novel logic, character consistency, pacing, and narrative bugs. Loading a .env file introduces access to environment-scoped data that is unrelated to the stated analysis purpose, and the code does not show any legitimate need for such secrets or configuration from the environment.
- Content