novel-master test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Chinese novel-writing assistant, but its helper scripts can write outside the intended project folder and its docs point users to an unverified external source.

Review this before installing. Use it only for Chinese novel projects, avoid passing untrusted book or character names to its scripts, and do not follow the external GitHub install path unless you verify a pinned release or commit. Prefer a version that validates paths and asks before creating or updating files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init_book.py:15

Finding

Unsanitized Project and Character Names Allow Workspace Path Traversal

Content

View full analysis

2 else "" # Create the project root directory base_dir = Path.home() / ".qclaw" / "workspace" / "novels" / book_name ``` `scripts/char_state.py:24-33`: ```python ROOT = Path.home() / ".qclaw" / "workspace" / "novels" def _chars_dir(book): return ROOT / book / "settings" / "characters" def _state_file(book, name): return _chars_dir(book) / name / "state.json" def _bus_file(book): return ROOT / book / "tracker" / "plot_bus.json" ``` `scripts/char_state.py:44-47`: ```python def cmd_init(book, name, bias=None): d = _chars_dir(book) / name d.mkdir(parents=True, exist_ok=True) sf = d / "state.json" ``` `scripts/ncg.py:18-21`: ```python ROOT = Path.home() / ".qclaw" / "workspace" / "novels" def _ncg_file(book): return ROOT / book / "tracker" / "ncg.json" ``` `scripts/track_foreshadowing.py:19-22`: ```python book_name = sys.argv[1] action = sys.argv[2] fp_file = Path.home() / ".qclaw" / "workspace" / "novels" / book_name / "tracker" / "foreshadowing.json" ``` `scripts/update_state.py:16-21`: ```python book_name = sys.argv[1] chapter = int(sys.argv[2]) words = int(sys.argv[3]) unresolved_fp = int(sys.argv[4]) if len(sys.argv) > 4 else None state_file = Path.home() / ".qclaw" / "workspace" / "novels" / book_name / "state.json" ``` ### Technical Analysis The scripts treat command-line values for book and character names as trusted path components. They do not reject absolute paths, directory separators, `.` or `..` co ...[truncated 2636 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Documentation Directs Users to Install Mutable Code from an Unverified External Repository

Content

View full analysis

📦 **v2.0.0 complete source code, including v2 scripts and reference documents, has been published on GitHub:** [`bbroot/novel-master`](https://github.com/bbroot/novel-master). The ClawHub marketplace page is the v1 entry point; obtain and install v2 content from GitHub. ``` ### Technical Analysis The documentation directs users to obtain and install Skill content from a mutable personal GitHub repository rather than solely from the reviewed marketplace artifact. It does not pin an immutable commit, provide a release checksum, require signature verification, or establish a verifiable relationship between the package publisher and the GitHub account. The reviewed `_meta.json` identifies the publisher only through an opaque owner ID: ```json { "ownerId": "kn71762330zyw1460ppmx2yktx89bgnj", "slug": "novel-master", "version": "2.0.0", "publishedAt": 1782374191451 } ``` This metadata does not cryptographically bind the artifact to `github.com/bbroot`. The GitHub badge at `README.md:23` is only a navigation link, not a direct executable download. No automatic remote payload retrieval, `curl | sh` pipeline, or remote code execution behavior was found in the packaged scripts. The risk arises from the explicit instruction at line 8 to obtain and install mutable external content. ### Attack Path 1. A user follows the README instruction to obtain v2 from the external GitHub repository. 2. The repository content changes after this artifact was audited, or the repository/account is compromised. 3. The user retrieves a mutable branch or unverified release without checking an immutable identifier or signature. 4. The externally sourced Skill instructions or Python scripts are installed. 5. The newly introduced content executes with the filesystem and Agent pe ...[truncated 786 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared purpose is a creative writing skill, but the content also instructs the agent to inspect local tracking files, maintain state, and invoke auditing/version-check commands. This mismatch is dangerous because users may consent to a harmless-seeming writing assistant without realizing it can access local workspace data and perform enforcement-style operations outside the advertised behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README presents the skill as a Chinese long-form novel creation package and all usage examples and core description are framed around Chinese writing by default. Although there is an 'English' anchor link, this file section does not offer a clear user language choice for operating the skill, which can violate language/locale policy when a specific language is imposed without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises one-click project scaffolding and describes a workspace directory structure, but does not warn users that files and folders will be created or modified. In agent contexts, this can normalize silent filesystem changes and increase the chance of unexpected writes in the user's workspace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The README says the AI will automatically load references, generate outlines, write chapters, and track foreshadowing, implying ongoing stateful workflow behavior across the session. In a skill with documented workspace state files, this increases the risk of persistent changes or continuity assumptions occurring without explicit per-step consent.

Content

Scanner excerpt · README_EN.md (reported line 89)May include surrounding context.

md

### Start Writing

Just tell your AI: **"I want to write a mystery novel"**

The AI will automatically:
1. Load genre references → 2. Generate a Creative Brief → 3. Produce Arc Outlines → 4. Write chapters → 5. Track foreshadowing → 6. Self-check quality

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README uses a very broad natural-language activation example ('I want to write a mystery novel') and states the AI will then automatically perform multiple actions. In an agent ecosystem, broad trigger phrasing can cause unintended invocation of the skill in ordinary conversation, which may lead to unwanted workflow execution or file operations without sufficiently explicit user confirmation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill describes file-oriented workflows, state tracking, and script-driven operations but does not declare any explicit tool scope or permissions boundary. That makes its effective file read/write capability implicit and harder to audit, increasing the risk of unintended workspace access or file modification if the agent binds tools automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text says the skill triggers when users ask to '写小说、创作故事、分章节写作、连续剧情、章节悬念、长篇小说', which is a broad list of common creative-writing requests without clear boundaries or exclusions. It does not define when the skill should not activate, so ordinary requests for stories or chapter writing could unintentionally invoke this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description states this is a '中文长篇小说' skill and the document later says the default target is publication-grade output, but it does not indicate that users can choose another language or locale. This creates a language policy concern because the skill appears to force Chinese as the working language by default rather than offering an explicit user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill file is written only in Chinese and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill content is entirely presented in Chinese, starting with the title, with no indication that language selection is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The text explicitly defines a Chinese-specific token estimation rule: '中文按 字数 × 1.5 估算 token', which imposes a locale/language assumption in the skill design. The document does not offer an opt-in, alternative handling for other languages, or a clear justification that this skill is intentionally limited to Chinese-only use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill document is written in Chinese and does not indicate that language selection is optional or configurable. Under the policy rule for natural-language violations, forcing a specific language or locale without user opt-in is reportable unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill description and command documentation are written only in Chinese, with no indication that users may choose another language or that the skill is intended exclusively for a Chinese-speaking or region-specific environment. Under the policy, a skill that effectively mandates a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The title "出版级文风指南" indicates the skill guidance is written to enforce a Chinese writing style, and the file provides prescriptive defaults and must/forbidden rules throughout without any opt-in or alternative language path. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, usage text, and later user-facing messages are presented only in Chinese, with no indication that the user can select another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script's natural-language interface—including the module description, usage output, and status messages—is fixed to a single language. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's natural-language interface, including the main docstring usage text, is entirely in Chinese and presents that locale as mandatory behavior. The policy scope covers language or locale constraints across all file types, and there is no opt-in, alternate locale, or justification that this skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s docstring, usage text, and later user-facing messages are entirely in Chinese, which imposes a specific language on all users. There is no indication that the tool is region-specific or that users can opt into another language, which fits the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The README describes the skill as a "Publication-Grade Chinese Novel" writing kit, which may indicate a language-specific output constraint. The document does not clearly state whether Chinese is optional or whether users can choose another language, creating a potential language-policy issue if the skill enforces Chinese by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document is entirely presented in Chinese starting from the title, with no indication that language choice is optional or that the skill is specifically intended for Chinese-speaking users only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This markdown file is written entirely in Chinese and does not indicate any language choice, translation option, or locale-specific justification. Under the policy for natural-language violations, content that effectively requires a specific language without user opt-in should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all instructional content exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy check, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs safety-relevant filesystem modifications by creating a project tree under the user's home directory and writing several files, but it does not warn the user before doing so. Although it prints a success message afterward, there is no pre-action confirmation, cautionary log, or explanatory comment/docstring disclosing the scope and location of the writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and CLI usage/error messages are written only in Chinese, which imposes a specific language on users without offering opt-in or alternatives. The policy explicitly calls for flagging language or locale constraints when they are forced and not clearly justified.

Content

No source excerpt is available for this finding.