Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese interactive story/style skill, but it under-explains a hidden cross-session notes feature that could retain user-provided story content.
Review this before installing if you do not want story notes retained across sessions or hidden from normal output. Avoid putting sensitive personal information into #隐藏楼层 or similar note commands, and prefer explicit # commands for reset, style changes, and plot actions.
Using "我要 [具体事]" as a command trigger is overly broad because it overlaps heavily with natural user intent statements in normal conversation. Since the system is instructed to interrupt the storyline and execute detected commands immediately, this can cause unintended action execution from casual phrasing rather than deliberate command use.
The file begins with a hidden Unicode BOM/zero-width character, which can be used to conceal instructions or cause parsers, diff tools, and security scanners to misread the true content. In a skill that defines command handling and instruction priority, hidden leading characters are more concerning because they can alter matching behavior or mask adversarial prompt content from reviewers.
# 第一章：核心系统
本章包含"梦之界·万象绘卷"的核心系统协议、世界观设定和指令系统，是使用本技能的基础。
This markdown file contains user-facing natural-language instructions and descriptions exclusively in Chinese, including the name, description, headings, and command explanations. Under the policy rule, forcing a specific language without user opt-in or a documented locale justification is a natural-language policy violation.
Although the file states it is reference material rather than runtime instructions, its natural-language content defines a mandatory output format, vocabulary, and stylistic behavior entirely in Chinese. There is no indication of user language choice or locale opt-in, which matches the language/locale policy violation category.
The entire skill documentation defines commands, examples, and usage solely in Chinese, with no indication that users may choose another language or that the locale restriction is intentional for a region-specific tool. This can constitute a language policy issue when a skill effectively forces one language without opt-in.
The single-word trigger "菜单" is broad enough to appear in ordinary conversation, yet this document says matching a command should immediately interrupt the current story and execute the function. Even with contextual filtering, a high-priority one-word command creates a realistic risk of unintended invocation and disruptive state changes.
A single-word trigger like "重置" is too permissive for a destructive operation that can wipe or alter current scene/world state. Accidental activation is especially risky here because reset actions are inherently disruptive and the document does not require confirmation before execution.
The reset feature is described as directly resetting the current scene or world state, but there is no warning, preview, or confirmation about state loss. In a stateful narrative system, silent destructive operations can cause denial of continuity, user frustration, and loss of progress.
Allowing ad hoc custom command generation without explicit trigger constraints undermines the safety model described elsewhere in the document. It opens the door to creating commands that collide with normal language, bypass existing safeguards, or introduce unreviewed destructive behaviors.
The skill is entirely presented in Chinese and the command syntax is Chinese-specific, with no indication that users may choose another language or that the skill is intentionally restricted to Chinese-only use. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill exposes very broad activation commands (#切换文风 [名称] / #文风 [名称]) without any visible scope limits, confirmation step, or exclusions. In a larger agent system, such generic triggers can be invoked unintentionally or by untrusted user content, causing persistent style changes that alter downstream behavior and may interfere with safety, instruction hierarchy, or task fidelity.
This markdown file presents all instructions and descriptive content only in Chinese, which can amount to a language-policy violation when users are not given an opt-in or alternative locale. The file does not state that it is intended exclusively for a Chinese-speaking or region-specific audience.
This markdown file defines writing styles entirely in Chinese and marks one Chinese internet-fiction style as the system default, with no indication that users can opt into another language or locale. That creates a natural-language policy issue because the skill appears to impose a specific language context by default rather than offering a choice.
The entire skill file specifies style guidance exclusively in Chinese and provides no indication that users may choose another language or locale. Under the policy rule, a skill that imposes a specific language without user opt-in is a natural-language policy violation.
The listed trigger conditions use broad phrases such as '剧情推进了一定距离', '需要记录新发生的事件', and '避免上下文过长' without defining clear thresholds or exclusion conditions. In a markdown skill file, this lack of specificity makes it unclear when the skill should activate versus not activate.
Phrases like '需要完整回顾整个故事', '准备进入新章节', and '上下文过长需要压缩' are open-ended and depend on subjective interpretation. Because the file does not provide precise boundaries or negative cases, the skill may invoke a full summary in situations where the user did not intend it.
The instruction '综合上文和前一场景，转换至另一条相关或衍生的故事线' does not clearly constrain what counts as a valid switch target or when switching is appropriate. Without a narrow trigger phrase or exclusion criteria, common requests about continuing a story could be interpreted as a story-line switch.
The document explicitly states that content supplied via #隐藏楼层 [内容] is stored persistently in a SQLite hidden_floors table across sessions, while also describing it as 'not shown to the user'. That combination creates a privacy and transparency risk: users or operators may input sensitive plot notes, personal data, or hidden instructions without realizing the data is retained beyond the current session and may later be accessible, exfiltrated, or reused unexpectedly.
This markdown skill content presents all instructions and guidance in a single language and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The file says "现在啥情况" may trigger based on context, but does not define clear boundaries for when it should versus should not activate. This creates ambiguity in invocation behavior for a common colloquial phrase.
The single-word trigger "世界观" can easily occur in ordinary discussion about setting or lore, so it risks accidental activation. The impact is lower because this command is informational rather than destructive, but it still weakens command/normal-conversation separation.
This markdown file presents all style instructions exclusively in Chinese and does not indicate that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
All instructions, commands, and examples are specified exclusively in Chinese, and the document does not state that users may choose another language. Under the language/locale policy, a skill should not force a specific language unless the constraint is explicitly documented and justified or the user is given a choice.
No suspicious patterns detected.