Security audit

novel-bug-checker

Security checks for vulnerabilities and agentic risk

Overview

This novel-checking skill is mostly purpose-aligned, but it asks for broad local workspace access and includes report templates/workflows that go beyond manuscript review.

Review this skill before installing if your manuscripts, character state files, or novel-master workspace are private. Use it only on explicit manuscript files, avoid the v2 cross-skill commands unless you trust the installed novel-master skill and the target book path, and check where logs/reports/visualizations will be written before sharing outputs.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no permissions, yet its instructions clearly require reading user files, writing output files, and accessing environment-dependent paths such as `~/.qclaw/...`. This mismatch weakens least-privilege controls and can mislead reviewers or runtime policy systems about the skill's actual capabilities.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The v2 section instructs the skill to access another skill's internal workspace and execute `novel-master` scripts from `~/.qclaw/skills/novel-master/...`. That creates unnecessary cross-skill trust and expands access to private state, which could expose unrelated data or let this skill influence or depend on privileged artifacts outside its stated bug-checking role.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation states that the skill only depends on `jieba`, but later requires external `novel-master` scripts and workspace artifacts to enable enhanced analysis. This under-disclosure can cause operators to approve or run the skill without understanding its true dependency and trust boundary expansion.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a novel-quality checker, but this example expands into software/API troubleshooting, which materially broadens the skill’s operational scope beyond its declared purpose. That kind of scope drift can cause the agent to respond to technical failure reports as if they are in-scope, increasing the chance of unintended debugging guidance, misuse of capabilities, or bypass of routing/policy controls that rely on the declared skill boundary.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script persistently writes a log file and later writes reports/JSON outputs to disk, which creates undeclared file-system side effects. When analyzing private manuscripts, this can leak sensitive content or metadata into predictable local files, especially on shared systems or when users do not expect retention.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The template includes extensive system diagnostics such as memory maps, process lists, CPU statistics, filesystem details, and kernel traces that are not necessary for a novel bug-checking skill. This increases data exposure and can leak sensitive host/environment information if the report is generated on a real user system or shared externally.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Including network-state and radio-log sections is unjustified for a text-analysis skill and exposes connectivity, interface, gateway, and radio-event information unrelated to the user task. Such data can aid environmental fingerprinting, reveal internal network layout, and expand privacy risk if reports are retained or exfiltrated.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The embedded example script gathers environment details like Python version, OS name, timestamps, and logging configuration that go beyond what novel-quality analysis requires. While not directly exfiltrating data by itself, it normalizes unnecessary collection and could lead downstream implementers to capture sensitive system context by default.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The file is presented as a summary-report template for a bug-checking skill, but it actually encodes a full bug-fixing and post-repair workflow, including repair execution, release handling, and operational follow-up. This creates a scope-expansion / indirect-instruction risk: downstream agents or maintainers may treat the template as authoritative and perform actions beyond the skill’s declared read-only analysis purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The template includes concrete operational actions such as publishing updated versions, modifying work pages, and notifying readers, none of which are necessary for a novel bug-checking skill. If an orchestration layer or human operator follows this content literally, the skill could drive unauthorized content changes or external communications, making the mismatch materially more dangerous in an agent environment.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation guidance is broad enough that ordinary user requests like 'Check this novel chapter for logic flaws' could unintentionally trigger the skill in general conversation. That can cause unplanned routing of user content into this skill's workflow, leading to incorrect tool selection, privacy surprises, or prompt-scope confusion even though the skill itself is not overtly malicious.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: A generic activation marker without defined triggers or exclusion conditions makes it unclear when the skill should engage, which can lead to over-broad invocation. In an agent setting, ambiguous activation boundaries increase the risk that unrelated user input will be interpreted as eligible for this skill, causing unintended behavior or interference with safer routing logic.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: This repeated generic activation pattern reinforces that the skill lacks bounded invocation rules throughout the examples, not just in one isolated case. Repetition in documentation can normalize broad autonomous triggering behavior, making downstream implementations more likely to call the skill in contexts it was never meant to handle.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The overall example set depicts the skill as always activatable but never constrained by a trigger policy, which is a design-level safety weakness rather than a single phrasing issue. When a skill’s examples omit boundaries, implementers may infer permissive activation semantics, increasing accidental invocation and cross-domain spillover.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation describes saving reports and generating files without warning the user or requiring confirmation, implying filesystem side effects as part of normal operation. In agent environments, undocumented write behavior can surprise users, overwrite data, leak sensitive content into artifacts, or violate least-privilege expectations.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The usage section suggests broad shell commands such as grep and sed over the report without clearly constraining scope, input trust, or execution context. In an agent or automated workflow, such patterns can encourage unsafe command construction, overly broad file access, or propagation of shell-oriented behavior beyond the intended artifact.

Static analysis

No suspicious patterns detected.