Security audit

Dragon Writer

Security checks across malware telemetry and agentic risk

Overview

This writing skill is mostly coherent for managing novel projects, but it needs review because it can silently contact a remote service and replace its own installed files before doing the user's writing task.

Install only if you trust the publisher and its update infrastructure. Before using it, consider disabling automatic updates in artifact/_meta.json or removing the startup update step, and expect the skill to create and modify files inside novel project folders. The dashboard is documented as local and read-only, but it may remember a browser folder handle after you grant access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares itself as a writing workflow but documents capabilities to read/write files, invoke shell commands, and access the network, including an automatic updater. Undeclared high-risk capabilities reduce user visibility and consent, and when combined with self-update behavior they enable code changes and local file modification outside the apparent scope of a fiction-writing skill.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior materially exceeds the stated purpose: instead of only managing story files, it performs remote version checks, downloads code, and replaces local skill contents. That mismatch is dangerous because users may invoke a benign-seeming writing tool that actually executes a software update pipeline with code-fetch and overwrite capability, creating a supply-chain and arbitrary code execution risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README presents the skill as a local, file-based writing workflow, yet it documents an automatic update mechanism that contacts a remote service and may download code. This expands the trust boundary from local-only operation to remote code acquisition, creating supply-chain and unexpected network-exposure risks if the endpoint, transport, or update source is compromised.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: A persistent fiction-writing skill does not inherently require autonomous network update behavior, so the feature is unnecessary relative to stated functionality and increases attack surface. Unjustified updater logic is dangerous because it can be abused to introduce malicious content or silently alter local behavior outside the user's expectations.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The startup path performs a remote update check and potentially applies downloaded changes before handling the user's requested task. Running network-dependent code and modifying the local skill prior to user work breaks the expectation of a local, tool-agnostic writing workflow and creates a pre-task compromise point if the remote source, transport, or updater logic is tampered with.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatic remote self-update is not necessary for the core function of drafting and maintaining fiction project files, so it adds attack surface without a strong functional justification. Any self-modifying mechanism that downloads and applies code increases the risk of supply-chain compromise, persistence, and unexpected behavior changes in future sessions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest enables remote update checks against an external service even though the skill’s stated function is local long-form writing/project management. That creates an unnecessary network interaction path that can expose usage metadata and, if the update mechanism is later trusted for installation decisions, expand the attack surface for supply-chain abuse.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: Automatic update checking is not clearly tied to the skill’s declared purpose, so it introduces avoidable external communication for a workflow that otherwise appears local. While not proof of exploitation by itself, unjustified background network access weakens user expectations and can leak environment or usage information.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements a self-updater that downloads remote content and overwrites the skill's own installation directory, including destructive replacement of existing files. For a story-writing skill, this is unnecessary and materially increases supply-chain risk: a compromised server, archive, or update path could deliver arbitrary malicious code or tamper with future skill behavior.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code executes an external CLI to install or upgrade the skill in place, which creates a code-execution path outside the skill's declared fiction-writing purpose. If the CLI binary is malicious, replaced in PATH, or fetches untrusted packages, the updater can execute attacker-controlled code and modify the environment.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill performs outbound network requests to obtain remote version metadata unrelated to its stated writing functionality. Even without immediate code execution, this creates unnecessary remote trust dependencies, exposes usage metadata, and serves as the precursor step for unsafe self-update behavior.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The script performs security-relevant checks for CSP and external dependencies, but even when those checks fail it still rewrites and emits the dashboard file and exits with status 0. In a build or CI pipeline, this can allow an unsafe dashboard artifact to be published despite detection of weakened CSP or added external resource loads, undermining the intended security gate.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The help text says dry-run is the default, but the code performs real writes unless --dry-run is passed. In an agent or automation context, operators may trust the documentation and unintentionally modify project state, creating integrity and rollback risks in persistent story data.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to perform networked update activity before user tasks and without a clear user-facing warning or consent step. This is dangerous because it can transmit environment-derived requests and modify local code transparently, denying the user an informed choice about remote contact and code changes.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: This workflow performs extensive multi-file writes, state updates, and snapshot creation, yet the visible skill content does not require an explicit user warning or confirmation before these changes occur. In a file-writing agent, that increases the risk of unexpected persistence, accidental overwrites, or broad project mutation when the user may have intended a narrower drafting action.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger guidance uses broad natural-language phrases like viewing progress, relationships, reading chapters, or opening the dashboard, which are common in ordinary conversation. In an agent skill, such loose activation criteria can cause unintended invocation in adjacent contexts, leading the agent to take filesystem-oriented actions or present workflow instructions when the user did not explicitly request this skill.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The 'when to invoke' section is overly broad because it authorizes activation for generic requests about progress, dashboards, completion, character relationships, or reading chapters, and also auto-applies during new/import flows. This increases the chance of accidental skill selection and unintended file-template injection behavior, especially in multi-skill environments where those phrases overlap with normal user requests.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger conditions are broad enough to activate on generic novel-writing requests such as a title, genre, or vague idea, which can cause the skill to take over workflows outside its intended narrow scope. In this skill, that matters because activation leads directly into persistent project initialization and file creation, so an ordinary writing request may unexpectedly result in filesystem changes and stateful project setup.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow directs the agent to create directories, write multiple files, save snapshots, and copy a dashboard asset, but it does not require explicit warning or confirmation before making filesystem changes. In a stateful agent environment, this can surprise users, create unwanted persistent artifacts, and increase the risk of accidental overwrite or unauthorized modification of project areas if path handling is not tightly constrained.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases include common conversational expressions such as '换个方向' and '下一章要写……' without stronger scoping conditions, so the workflow could activate during ordinary discussion rather than an explicit command to modify project state. In a stateful writing skill that updates canon, focus, and chapter intent files, unintended invocation can cause unauthorized or accidental narrative-state changes across sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The update path destructively deletes and replaces files in the installation directory without explicit user confirmation at the moment of action, and startup workflow text indicates it may run automatically. This increases the blast radius of any compromised update source or logic error and can silently alter code, prompts, or behavior in later sessions.

External Transmission

Medium

Category: Data Exfiltration
Content: 版本控制逻辑： - 本地版本存储在 `_meta.json` 的 `version` 字段 - 远程版本从 `https://api.skillhub.cn/api/v1/search?q=d-writer` 获取（slug=`d-writer`） - 语义化版本对比（`x.y.z`）：本地 < 远程时执行更新 - 更新方式：优先 `skillhub` CLI，回退到直接下载 zip - 任何错误均跳过，不中断 skill 运行
Confidence: 94% confidence
Finding: https://api.skillhub.cn/

External Transmission

Medium

Category: Data Exfiltration
Content: - 本地版本 < 远程版本 → 执行更新。 - 本地版本 >= 远程版本 → 跳过。远程版本来源：`https://api.skillhub.cn/api/v1/search?q=d-writer`（slug=`d-writer`）。 > **手动检查更新**：运行 `python scripts/auto_update.py status --verbose`。 > **禁用自动更新**：编辑 `_meta.json` → `update.enabled: false`。
Confidence: 94% confidence
Finding: https://api.skillhub.cn/

External Transmission

Medium

Category: Data Exfiltration
Content: "homepage": "https://api.skillhub.cn/user_59dee265/d-writer", "update": { "enabled": true, "check_url": "https://api.skillhub.cn/api/v1/search?q=d-writer", "install_dir": ".", "auto_check": true, "skip_on_error": true
Confidence: 96% confidence
Finding: https://api.skillhub.cn/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.