T09 · Insecure Skill Coding Practices
Error
- Location
novelforge_engine/settlement.py:143- Finding
Project Directory Symlinks Permit Filesystem Access Outside the Project Root
- Content
View full analysis
- Remediation
View remediation
Security audit
NovelForge
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent novel-writing skill, but it needs Review because some local file tools are under-scoped and can modify, read, or delete outside the intended project boundary.
Install only in a dedicated, trusted novel workspace. Do not run it on projects or engine folders from untrusted sources until the author enforces project-root path confinement, rejects symlinked project folders, and restricts the patch script to hash-checked chapter files. Expect Chinese-first interaction and persistent .novelforge project state.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/apply_patch.py:52- Finding
Patch Utility Can Replace Arbitrary Accessible UTF-8 Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A file patch facility that can target arbitrary paths, combined with integrity/hash logic and atomic writes, is a real security-sensitive capability in an agent skill. Even if intended for chapter editing, such machinery can be misused to overwrite unrelated local files, modify configuration, or tamper with code unless strict path boundaries are enforced.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger scope is extremely broad, covering many common authoring phrases and workflow requests, which increases the chance of accidental or overbroad activation. In a skill that can read, write, patch, audit, and invoke shell-based scripts, overly permissive natural-language activation materially raises the risk of unintended state-changing operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
该文件以中文明确描述整个技能及其使用方式，但未说明是否支持其他语言，也没有给出用户可选择语言/locale 的提示。按规则，若技能在自然语言层面强制特定语言且无用户 opt-in，可视为语言/locale 政策风险。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares it requires local binaries and describes filesystem-changing workflows, but it does not declare any explicit tool/permission scope. In an agent environment, missing tool scoping can allow broader-than-necessary file and shell access, increasing the chance of unintended modification or abuse if the skill is triggered in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s description and all operating instructions are written exclusively in Chinese, indicating the skill is intended to operate in a specific language/locale. The file does not offer a user language choice or explain a justified region-specific constraint, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written as a Chinese-only role definition, and the body of the skill continues entirely in Chinese, indicating a fixed language/locale expectation. Because the file does not offer opt-in language selection or explain that the skill is intentionally region-specific, this is a natural-language policy concern under the locale-choice rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest file contains user-facing natural-language prompt content exclusively in Chinese across multiple model entries. Because the file provides no indication that the skill is region-specific or that users can choose language/locale, it appears to impose a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill guidance is written only in Chinese, with no indication that users may opt into another language or locale. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as region-specific or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Multiple eval prompts are written as direct Chinese-language instructions, which effectively impose a specific language/locale on skill behavior. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON file defines the skill's trigger evaluation examples entirely in Chinese, which signals an implicit language constraint for activation and expected usage. Because there is no accompanying indication that other languages are supported or that Chinese is an opt-in requirement, this can violate the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Mandating Simplified Chinese for all human interaction without user opt-in can override user preferences and make the skill activate or continue in a language mode the user did not request. This is primarily a safety/usability control issue rather than direct code execution, but it increases the chance of user confusion, consent mismatch, and incorrect handling in multilingual environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises very broad natural-language triggers such as ‘继续’, ‘恢复’, ‘写小说’, and other common phrases, which can cause the agent to invoke this workflow in contexts the user did not clearly intend. Because invocation leads to filesystem-oriented commands and pipeline advancement behavior, accidental activation could redirect the assistant away from the user’s actual task or cause unintended project-state changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code embeds Chinese-language prompt text in default model cards and repeatedly generates Chinese-language markdown content and research summaries. The file provides no user choice of language and no documented reason that the engine must be Chinese-only, which conflicts with the policy against forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This is a code file, so SQP-3 applies to natural-language policy violations found in docstrings. The description explicitly says the skill provides 'standard Chinese webnovel genre taxonomy', which signals a forced language/locale orientation without any user choice or documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code embeds multiple user-facing artifact descriptions entirely in Chinese, such as project/profile and blueprint instructions. That creates an implicit language policy constraint without offering a user language choice or documenting a justified locale restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code deletes wiki files via unlink() when cleaning up obsolete facts, but there is no confirmation prompt, logging/print statement, or nearby comment/docstring that clearly discloses this deletion behavior to the user. This is a safety-relevant destructive operation because it irreversibly removes files derived from prior settlement state.
- Content