Chinese Novelist Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese novel-writing workflow that creates local story files and runs a simple local word-count script, with no evidence of hidden access, network use, persistence, or destructive behavior.

Install this if you want an agent to generate a Chinese multi-chapter novel in your local workspace. Expect it to create and repeatedly update markdown files under a novels/[novel name] folder and to run the included word-count checker; use a dedicated project folder if you want to keep the generated manuscript separate from other work.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a creative-writing assistant, but its workflow includes local file creation, repeated file modification, and script-based validation that are not clearly disclosed in the high-level description. This mismatch can mislead users into invoking a skill with operational side effects they did not knowingly authorize.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The README presents the skill as a `chinese-novelist` skill and states that it writes a complete Chinese novel, which imposes a language constraint in the skill description. There is no indication that the user can opt into another language or that the Chinese-only requirement is a documented, justified regional constraint.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README presents automatic generation of multiple files under a workspace-style directory structure, but it does not clearly warn users that invoking the skill may create or write files. In an agentic coding environment, undisclosed write behavior can surprise users, overwrite existing content, or cause unintended bulk file creation, especially when the skill is described as proceeding automatically after confirmation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill instructs reading and modifying local project files but does not declare an explicit tool scope or permissions boundary. This makes the file-access behavior less transparent and increases the chance that an agent may use filesystem capabilities more broadly than the user expects.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The description and title define the skill as producing Chinese novels and repeatedly frame the workflow as Chinese-only output, but they do not offer the user a language option or explain a necessary regional constraint. This is a natural-language locale policy issue because the skill forces a specific language without opt-in.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation text includes broad phrases such as “写小说”, “创作故事”, and “长篇小说创作”, which can easily match ordinary user requests for storytelling rather than a narrowly scoped skill invocation. The file does not provide exclusion conditions or negative examples to clarify when the skill should or should not activate.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs creation of directories and repeated modification of local files without an explicit warning or opt-in. In the context of a broadly triggered writing skill, this is dangerous because users may expect text generation only, not persistent filesystem changes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill requires executing a local Python script to validate word counts, introducing command-execution behavior into a writing workflow. Even if the script appears benign, any unnecessary subprocess execution expands the attack surface and can be abused if the script or paths are tampered with.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs command/script execution without any explicit warning to the user, despite being framed as a content-creation assistant. Hidden command execution in a non-administrative workflow is risky because it can surprise users and enable abuse through modified scripts, unsafe paths, or unintended repeated runs.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file presents all instructions in a single language and does not provide any user opt-in, alternative locale, or justification for restricting content to Chinese. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents all instructions in Chinese and does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file is written entirely in Chinese and does not provide any language-selection option or note that the skill is intentionally limited to Chinese-language users. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document title and all instructional content are presented only in Chinese, with no indication that language choice is optional or that the file is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file title and instructions are entirely in Chinese and present the checklist as the required format for quality review, but there is no indication that users may opt into another language or that the skill is restricted to a Chinese-language context. This creates a natural-language locale policy concern because it implicitly forces a specific language without user choice.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file contains instructional content only in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown template appears to require use of Chinese for headings and field labels such as character attributes. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative is provided.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The entire skill is written as Chinese-only guidance, with no indication that users can opt into another language or that the skill is intended for a specifically Chinese-language context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This file presents all guidance in a single language and does not provide any user opt-in, alternative locale, or justification for the language restriction. Under the language/locale policy rule, forcing a specific language without documented choice or rationale is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This code file contains natural-language instructions, messages, and usage text exclusively in Chinese, starting with the module docstring. Under the policy criteria, forcing a specific language without opt-in can be a locale/language policy violation when no alternative language or justification is offered.

Static analysis

No suspicious patterns detected.