T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
言情小说分匠/character-architect.agent.md:5- Finding
Delegated Agents Receive Capabilities Beyond Their Documented Responsibilities
- Content
View full analysis
- Remediation
View remediation
Security audit
书匠
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real Chinese romance-writing workflow, but it asks for broad command, browsing, editing, and agent-delegation powers that are not tightly controlled.
Install only if you are comfortable with a skill that can create and overwrite project files, browse listed novel-ranking sites, and invoke shell utilities. Run it in a sandboxed workspace, review filenames before execution, and avoid giving it sensitive directories or credentials.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (21)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest context says the skill should be used to orchestrate five novel agents into a traceable, rollback-capable, quality-gated end-to-end romance creation pipeline. This file instead defines a 'Novel Hotspot Crawler' whose only job is to browse ranking websites, analyze trending topics, and write JSON reports, which is a materially different function.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims access is limited to the project root, but later instructs shell commands like
wc -m {小说标题}-正文.mdand{小说标题}-番外篇.mdusing unsanitized title-derived filenames. If the title contains path separators, traversal sequences, shell metacharacters, or absolute paths, the agent may read unintended files or operate outside the declared boundary.- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md Apply in every response: - Constraint-first: hard constraints override heuristics - Character-source only: only use provided character design files as story source - No content intervention: do not validate, correct, optimize, or rewrite character-file content - Process explicitness: fixed phases, fixed outputs, fixed gate checks - Measurable delivery: every phase has completion evidence
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md ### F3. Content Filtering Mechanism (Required) Keep: - Input/output rule enforcement - Plot causality chain - Character and relationship progression - Pacing and setup/payoff controls
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly requires filesystem writes, shell execution, and network access, but it does not clearly surface these side effects to the user as a safety warning or consent checkpoint. In an orchestration skill that creates directories, writes multiple artifacts, and fetches external content, this can lead to unexpected data creation, external requests, and broader system interaction than a user may realize.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - `concise_mode`: - Never call `#tool:vscode/askQuestions`. - For missing non-critical design fields, auto-decide from hotspot artifacts (project `novel-hotspots/*.json`) and record `auto_decision` + rationale. - If critical fields are still unavailable after hotspot-based inference, return blocking status with missing-field list; do not ask user directly. - `detailed_mode`: - For every missing required field, call `#tool:vscode/askQuestions` to ask targeted questions before continuing. - Do not auto-fill user intent fields when answers are not explicitly provided.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file instructs the agent to ask users targeted questions in Chinese and later produce Chinese-formatted output elements, while much of the surrounding contract is written in English. There is no explicit user opt-in or language-selection mechanism, so the skill effectively forces a locale/language choice in part of the interaction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The agent is granted powerful tools including execute, edit, and broad workspace access even though its stated purpose is web retrieval and JSON reporting. Excessive capability increases blast radius: if the prompt is subverted or the agent misbehaves, it can modify files or run commands unrelated to hotspot analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to write JSON outputs into the project folder without clearly informing the end user that local files will be created or modified. Unexpected filesystem side effects can surprise users, overwrite artifacts, or be abused to plant data in repositories where downstream tools may trust generated content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The input contract sets
regiontoCNandlanguagetozh-CNby default. This imposes a specific locale unless the user overrides it, and the file does not present it as an opt-in choice or narrowly justified regional limitation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Requiring
mkdir -p novel-hotspotsthrough shell execution introduces a filesystem-changing side effect without explicit user warning and uses a more powerful mechanism than necessary. Even though the target path is nominally constrained, shell usage expands the attack surface compared with a dedicated directory/file API.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill grants broad tools including general code execution and web/browser access even though its stated role is manuscript quality inspection. This unnecessarily expands the attack surface: untrusted manuscript content or title-derived instructions could induce filesystem, network, or command actions unrelated to QA.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The role is explicitly defined as a 'Chinese novel quality inspector', and the description also limits the QA function to 'Chinese novel QA'. This imposes a language-specific constraint in the skill's natural-language behavior without offering user opt-in or documenting a clear region-specific compliance justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The argument hint requires input files to follow a Chinese naming convention and specifies a Chinese output filename. This imposes a specific language/locale format on users without any opt-in or documented regional justification, which matches the policy-violation criterion for forced language/locale use.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - `concise_mode`: - Never call `#tool:vscode/askQuestions`. - For missing non-critical planning fields, infer from hotspot outputs and approved character files; record `auto_decision` + rationale. - If critical input files are missing, return blocking checklist without asking user questions. - `detailed_mode`: - For missing required files or naming corrections, call `#tool:vscode/askQuestions` with targeted options. - Do not auto-decide user-facing constraints when explicit confirmation is required.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill accepts only files named with Chinese terms and enforces a single-project naming structure using that pattern. Because this is presented as a mandatory constraint rather than an optional locale-specific mode, it constitutes a natural-language locale policy violation under the stated rules.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The agent is instructed to output the final file strictly as
项目名称-剧情设计.md, which hardcodes a Chinese-language naming requirement. No user choice or explicit region-specific justification is provided, so this is a locale-policy issue.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description requires a Chinese manuscript, and the instructions further lock the agent into being a Chinese short-novel writer and producing Chinese-only output. This is a language policy constraint expressed in natural language without any user language selection or documented justification for enforcing a single language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to always create or overwrite
{小说标题}-正文.mdand potentially create an additional side-story file, but it does not require user confirmation at execution time. Even though the scope is limited to the current project root, silent overwrites can destroy or replace existing project content, especially if a file with the same name already exists.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md --- name: Novel Quality Inspector description: "Use this agent to run rigorous, quantifiable Chinese novel QA: logic, structure, pacing, character consistency, language quality, and compliance risk." argument-hint: "Please provide the text to be reviewed, including but not limited to: theme/subgenre, era and world setting, narrative person and perspective control, target audience, scope of review (excerpt/chapter/full manuscript), and the author's stated goals or concerns." tools: [vscode, execute, read, agent, edit, search, web, browser, todo] user-invocable: true ---
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md --- name: Novel Quality Inspector description: "Use this agent to run rigorous, quantifiable Chinese novel QA: logic, structure, pacing, character consistency, language quality, and compliance risk." argument-hint: "Please provide the text to be reviewed, including but not limited to: theme/subgenre, era and world setting, narrative person and perspective control, target audience, scope of review (excerpt/chapter/full manuscript), and the author's stated goals or concerns." tools: [vscode, execute, read, agent, edit, search, web, browser, todo] user-invocable: true ---
Static analysis
No suspicious patterns detected.