Security audit

novel-bug-checker

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Chinese novel-auditing tool, but it needs Review because it can cross into another local skill’s workspace/scripts and its dependency, environment, and file-output behavior is under-scoped.

Review before installing. Use it only on novel projects you trust, preferably in an isolated environment. Be cautious with the optional novel-master v2 integration because it runs code from another local skill path; only enable that after verifying the other skill and confirming the project path. Pin and install dependencies yourself rather than following broad pip prompts, and avoid running it in directories containing sensitive .env files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/logic-analyzer.py:43
Finding: Unnecessary Automatic Loading of Environment Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned and Inaccurately Documented Third-Party Dependencies
Content: View full analysis
⚠️ 首次使用前请确认依赖已安装，否则脚本将无法运行。仅依赖 `jieba`（中文分词），无需重型NLP库。 ``` ```python # scripts/logic-analyzer.py try: import pandas as pd import numpy as np import networkx as nx import jieba import jieba.posseg as pseg from dotenv import load_dotenv except ImportError as e: print(f"缺少必要的依赖库: {e}") print("请运行: pip install pandas numpy networkx jieba python-dotenv") sys.exit(1) ``` ```python # scripts/consistency-checker.py try: import pandas as pd import numpy as np from sklearn.metrics.pairwise import cosine_similarity from sklearn.feature_extraction.text import TfidfVectorizer import spacy from dotenv import load_dotenv except ImportError as e: print(f"缺少必要的依赖库: {e}") print("请运行: pip install pandas numpy scikit-learn spacy python-dotenv") sys.exit(1) ``` ```python # scripts/rhythm-analyzer.py try: import pandas as pd import numpy as np from scipy import signal, fft import jieba import jieba.posseg as pseg import matplotlib.pyplot as plt from matplotlib import cm from textblob import TextBlob from textblob.translate import Translator except ImportError as e: print(f"缺少必要的依赖库: {e}") print("请运行: pip install pandas numpy scipy jieba matplotlib textblob") sys.exit(1) ``` ### Technical Analysis The Skill documentation states that `jieba` is the only dependency, but the executable scripts require numerous additional packages. When an import fails, the scripts tell users to install broad package sets with no version constraints, hashes, or reviewed lock file. Installing mutable package versions by name allows de ...[truncated 1283 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: Unquoted User-Controlled Values in Documented Shell Commands
Content: View full analysis
[-o <输出文件>]` | | `rhythm` | 节奏分析 | `python scripts/rhythm-analyzer.py <文件路径> [-g <类型>]` | | `consistency` | 角色一致性检查 | `python scripts/consistency-checker.py <文件路径> [-o <输出文件>]` | ``` ```bash python scripts/logic-analyzer.py <文件路径> [-o <输出文件>] ``` ```bash python scripts/consistency-checker.py <文件路径> [-o <输出文件>] ``` ```bash python scripts/rhythm-analyzer.py <文件路径> [-g <类型>] [-o <输出文件>] ``` ```bash python ~/.qclaw/skills/novel-master/scripts/auditor.py check-version <书名> python ~/.qclaw/skills/novel-master/scripts/ncg.py view <书名> causal ``` ### Technical Analysis The instructions present user-derived file paths, output paths, genres, and book names as unquoted substitutions in shell commands. The Python scripts use `argparse` and do not themselves invoke a shell, but an Agent or wrapper following the instructions may construct a command string and pass it to a shell. If an attacker-controlled value contains shell metacharacters, command substitution, redirection, or separators, the shell may interpret that content as syntax rather than as one argument. The vulnerability is therefore in the documented invocation pattern and any automation that performs direct textual substitution. ### Attack Path 1. An attacker supplies a novel path, output path, or book name containing shell syntax. 2. An Agent substitutes the value directly into one of the documented command templates. 3. The resulting command is passed to a shell. 4. The shell parses the injected metacharacters. 5. The attacker’s command executes with the same privileges as the Agent or user. This path re ...[truncated 548 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:190
Finding: Execution of Mutable Scripts from an Unaudited External Skill
Content: View full analysis
当被检查的作品由 **novel-master v2 架构**创作（存在 `~/.qclaw/workspace/novels/<书名>/tracker/ncg.json` > 与 `settings/characters/*/state.json`）时，bug-checker 可直接消费这些产物，做**更高精度的定向排查**： 1. **OOC 检测**：拿正文里的角色言行，对照其 `state.json` 的 `cognitive_bias_pack` 与 `relationships`，发现「角色突然说出了不属于自己偏差包的话 / 与关系网矛盾的行为」→ 直接定位 OOC 行。 2. **地理/时间穿越**：对照 NCG 节点的 `location` 与章节号，标出无过渡的位移（与 auditor 门禁互补，做二次把关）。 3. **伏笔断裂**：对照 `ncg.json` 的 `伏笔`/`因果` 标签节点与 `foreshadowing.json`，找出「埋了没收」或「收得不在窗口」。 4. **版本回退告警**：调用 `auditor.py check-version <书名>`，把角色状态版本异常列入 🔴 致命级。 **v2 联动命令**（需 novel-master 脚本存在）： ```bash python ~/.qclaw/skills/novel-master/scripts/auditor.py check-version <书名> python ~/.qclaw/skills/novel-master/scripts/ncg.py view <书名> causal ``` ``` ### Technical Analysis The optional v2 workflow directs the Agent to execute Python files from a separate `novel-master` installation under the user’s home directory. Those files are not included in this project and were not available for review as part of this audit. This makes the effective behavior dependent on mutable local code outside the audited package. A malicious or compromised external script can inherit the trust users place in this Skill and execute when the optional integration is selected. The project does not modify or spoof those scripts itself. The risk arises because it invokes them without an integrity check, version constraint, ownership validation, or explicit trust confirmation. ### Attack Path 1. An attacker compromises, replaces, or plants one of the expected files under `~/.qclaw/skills/novel-master/scripts/`. 2. The user requests analysis of a work using the documented v2 architecture. 3. The Agent follows `SKILL.md` and invokes `auditor.py` or `ncg.py`. 4. Python executes the attacker- ...[truncated 547 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 声明描述的是一个广义的小说Bug检查专家，覆盖逻辑漏洞、角色不一致、节奏问题和叙事Bug等多个维度；而代码几乎全部围绕“节奏”展开。它确实覆盖了声明中的一部分——节奏问题/叙事节奏质量，并且会输出分级问题、证据、修复建议和报告，这部分是吻合的。但代码没有实现对情节逻辑漏洞、人物设定一致性、角色行为前后矛盾等核心“Bug检查专家”能力，因此其实际能力范围显著窄于声明的核心承诺，属于描述与行为不符。另有一些附加能力如可视化、傅里叶分析虽不一定构成严重风险，但也未在声明中体现。综合判断为存在明显不匹配。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is described as a professional-grade Chinese novel auditing tool and the usage/dependency sections reinforce Chinese-only operation. While a bilingual anchor is present, the actual README content and stated purpose constrain usage to Chinese without explicitly offering a user language choice or documenting the locale restriction as a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README directs users to execute Python scripts from a different skill (~/.qclaw/skills/novel-master/scripts/...) to perform checks. That expands the trust boundary beyond this skill’s stated purpose and can cause an agent or user to run external code not reviewed as part of novel-bug-checker, creating a supply-chain style risk if the external skill is compromised or unexpectedly powerful.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description explicitly limits the tool to 'auditing Chinese novel narrative quality,' which is a natural-language locale constraint. The file does not present this as an optional mode or explain a region/compliance reason, so it appears to force a specific language context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares executable commands and instructs the agent to read files, invoke Python scripts, and access user-provided paths, but it does not declare an explicit tool scope or permission boundary. That increases the chance of over-broad file and environment access at runtime, especially because later sections also reference home-directory resources and external scripts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and title are entirely in Chinese, and the skill requires the jieba Chinese tokenizer, indicating the skill is designed around Chinese-language use. The file does not explicitly state that the skill is limited to Chinese novels or offer users a language/locale choice, so it imposes a locale constraint without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly reaches into another skill's workspace and state under ~/.qclaw/workspace/novels/... and calls tooling from ~/.qclaw/skills/novel-master/scripts/. Cross-skill access breaks isolation boundaries and can expose private project state, metadata, and auxiliary tooling unrelated to the current user's immediate request, creating a strong risk of unauthorized data access and privilege expansion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example implies the skill may activate for any request to 'check plot issues' without specifying limits on supported inputs, outputs, or adjacent domains. This ambiguity makes prompt routing overly permissive and can let users steer the skill into unreviewed tasks, especially given the later examples that already show scope expansion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation example uses a broad trigger ('激活小说Bug检查技能') without clear gating conditions, boundaries, or refusal criteria. In an agent setting, underspecified activation can cause the skill to engage on loosely related prompts, increasing the chance of unintended behavior, prompt routing errors, or use outside its intended domain.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 技能清单将该技能描述为用于检查小说中的逻辑漏洞、角色一致性、节奏问题和叙事Bug，但本示例段落直接处理小说阅读器应用的 JSON 解析失败、API 响应格式变更和版本回退等软件工程问题。这不是对小说文本质量的检查实现细节，而是明显扩展到了应用运维/技术故障排查。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation states that reports and artifacts are 'saved' and 'generated' without warning the user, confirming consent, or describing destination and overwrite behavior. In an agent environment, this normalizes silent file creation and potential overwriting, which can lead to data loss, privacy issues, or unexpected side effects on the host system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, a skill that implicitly forces a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for checking novels for logic holes, character inconsistency, pacing, and narrative bugs. However, this section documents a five-step framework using error messages, code snippets, runtime context, reproduction steps, and logs, which aligns with software bug diagnosis rather than literary analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This guide presents all instructions exclusively in Chinese and does not indicate user opt-in, multilingual availability, or a region-specific justification for the language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown reference file is written entirely in Chinese and does not indicate that language selection is optional or limited to a justified Chinese-only context. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file is entirely written as Chinese-only operational guidance, with no indication that users may choose another language or that the skill is restricted to a Chinese-language context. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a 'novel bug checker' that checks logical漏洞、角色不一致、节奏问题或叙事Bug and provides graded reports. In this file, the implemented checks are limited to character consistency, timeline consistency, plot logic via simple regex patterns, and foreshadowing payoff checks; there is no pacing-analysis logic or broader narrative-quality analysis despite the broad claim.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language descriptions and CLI/help text entirely in Chinese, and later emits Chinese-only user-facing status/error messages. There is no visible opt-in, locale selection, or documented justification that the skill is intended only for Chinese-language users, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level docstring says the script uses an '智能上下文理解系统 - 基于向量检索的上下文感知技术' and combines a rule engine with semantic similarity computation. In practice, the code initializes a TF-IDF vectorizer and an unused vector_store, but all implemented checks rely on regexes and a simple set-overlap similarity function; there is no retrieval pipeline or AI/model-backed context understanding.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains user-facing natural-language content entirely in Chinese, including the main module docstring and later CLI help text, but it does not offer users any language/locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is justified, which is not documented here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a novel bug-checking skill focused on analyzing narrative logic, character consistency, pacing, and story bugs. This code unconditionally loads a .env file via python-dotenv, introducing configuration/secret access capability that is not used elsewhere and is not justified by the stated text-analysis purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argparse description, examples, argument help strings, and printed status/error messages are all presented only in Chinese. Because these strings define the user interaction surface and do not provide a language option or justified region-specific scope, they violate the language/locale policy described in SQP-3.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains user-facing natural language in the module docstring and command-line help/output exclusively in Chinese. Because the skill does not offer a language or locale choice, it effectively forces a specific language on users, which matches the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes a novel bug-checking expert that inspects text and provides graded reports and fix suggestions, but this script also performs persistent filesystem writes by creating a log file, saving visualization images, and writing markdown reports. While generating a report is aligned with the purpose, the additional automatic persistence of logs and chart files is a broader operational behavior than the manifest states.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argparse description, help text, examples, and printed status/error messages are all Chinese-language user-facing strings. Since there is no flag or configuration to select another language, the script enforces a specific locale rather than offering user choice.
Content: No source excerpt is available for this finding.