Security audit

book_writer

Security checks for vulnerabilities and agentic risk

Overview

This is a writing-assistance skill made of Markdown guidance, with no hidden execution, persistence, or credential handling found.

Installers should understand that this skill appears safe from a security perspective, but it may steer outputs toward Chinese academic-book conventions unless the user explicitly asks for another language or style. Users should provide only the reference folders and source materials they intend the assistant to read.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill's only concrete user/assistant examples are written in Chinese and demonstrate the assistant responding in Chinese, but the document does not state that language selection is user-driven or optional. For a general-purpose manuscript-writing skill, this can imply a language/locale default without user opt-in, which matches the policy category for language or locale constraints.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document states that conventions are extracted from Chinese academic book manuscripts and then instructs authors to use first-person plural '我们' as the default perspective. This imposes a specific language/locale expectation in natural-language guidance without indicating that users may choose another language or opt in to Chinese-only output.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The Overview explicitly narrows intent to book manuscripts, theoretical chapters, and argument-driven essays, and expressly excludes IMRaD-style conference or journal papers. Later, the Resources section lists ACM and IEEE formatting specifications, which directly point toward conference/journal production workflows and therefore undercut the stated exclusivity. This is a documentation-level contradiction even though no executable code is present.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The documentation states the skill 'does NOT generate IMRaD-style conference or journal papers,' framing the skill as exclusively for book-manuscript-style writing. However, the Resources section includes `ieee_formatting_specs.md` and `acm_formatting_specs.md`, which are conventionally used for conference/journal paper formatting rather than book chapters. This suggests support for a broader writing scope than the manifest description claims.

Static analysis

No suspicious patterns detected.