Security audit

Novel Director

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local novel-writing assistant that saves and reloads story project files for continuity, with no executables, network behavior, or credential handling found.

Install if you are comfortable with the assistant saving drafts, chapter files, indexes, and world/character notes locally. Use explicit project names when loading or saving, avoid putting sensitive personal information in story projects, and review or delete the local project folder when you no longer want the content retained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes generic phrases such as '写小说', '继续写', and '保存' that are common in ordinary conversation and could activate the skill unintentionally. Because this skill also performs stateful actions like loading and saving project files, accidental activation can cause unexpected file operations or context switching rather than merely producing harmless text.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README describes automatic loading on vague inputs like '继续写', '继续创作', or '恢复小说' in a new session, without a clear project identifier or confirmation flow. This ambiguity can cause the agent to load the wrong project or expose prior session content unexpectedly, which is especially risky in a tool designed for cross-session persistence.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README instructs the AI to save and export user-generated content to specific filesystem paths, but it does not clearly warn users about persistence, retention, overwrite behavior, or where data will be stored. In a long-form writing tool with cross-session continuity, silent persistence increases the risk of unintended data retention, privacy exposure, and accidental modification of local files.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes very common phrases such as '写小说', '继续写', and '保存', which can plausibly appear in ordinary conversation and cause the skill to activate unintentionally. In this skill's context, accidental activation is more concerning because the skill also defines save/load behaviors and project-file operations, so an unintended trigger could shift the assistant into a file-manipulating workflow without clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the AI to read from and write to paths like 'projects/小说名/world_knowledge.json' and chapter/draft files, but it does not warn the user, constrain paths, or require explicit consent for local file access. In context, this is more dangerous because the load/save commands are paired with broad natural-language triggers, increasing the risk of unauthorized reads, unintended overwrites, privacy leakage from local content, and path manipulation if the novel name is attacker-controlled.

Static analysis

No suspicious patterns detected.