Narrative Architect Skill

• Outcome: Pass
• Latest audit: Jun 21, 2026 · 2:20 AM UTC
• Version: 1.0.1

Overview

This is a text-only writing skill with broad communication guidance, and the reviewed behavior fits its stated purpose without evidence of hidden execution, exfiltration, or destructive actions.

Install this if you want a broad writing and messaging assistant that may use available conversation, memory, and workspace context to draft better public or private communications. Review outputs carefully for sensitive personal messages, high-profile outreach, public claims, and any workspace-derived assumptions before sending or publishing.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The harness states it runs before final output for every task and requires a locked language input, which creates a mandatory language constraint not clearly tied to explicit user choice. In a writing skill, this can override the user's latest intent, produce outputs in the wrong language, and weaken reliability or policy compliance around honoring user-specified locale and format preferences.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Calling language match a 'delivery contract' makes the constraint mandatory rather than user-selectable, encouraging the system to preserve a prior lock even when the user changes languages or requests a different output mode. In this skill context, that can cause systematic misalignment with user instructions across pitches, emails, and drafts, reducing trust and potentially causing downstream business or communication errors.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The mapper is defined to run when a user 'names or implies' a broad class of recipients, which is ambiguous and can cause unintended activation in ordinary writing tasks. In an agent pipeline, overly broad routing can misclassify user intent and apply high-power persuasion constraints or recipient profiling where they are not warranted, producing inappropriate or manipulative outputs.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad and lack scope constraints, so phrases like 'message [public figure]' or 'convince [high-status recipient]' may activate on partial matches, quoted text, hypothetical discussion, or analytical tasks rather than actual messaging requests. In this skill context, that broad triggering increases the chance of unnecessary recipient power profiling and persuasive optimization for sensitive targets such as CEOs, regulators, or public figures.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The policy hardcodes Chinese-language examples and a preferred Chinese follow-up question as the default recovery behavior without any language-selection step. In a general-purpose writing skill, this can cause unintended language switching, user confusion, and disclosure or reputational risk if the model responds in the wrong language or audience context during sensitive communications.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The policy activates on very broad phrases such as 'website copy', 'developer documentation', and 'public announcement' without clear exclusion or precedence rules. In an agent skill, this can cause the public-release policy to be applied to many ordinary writing requests, potentially steering outputs toward disclosure, branding, or publication-oriented behavior when the user did not intend that mode.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The branch trigger phrases are broad enough that ordinary user requests could accidentally invoke a specialized path, causing the skill to apply the wrong policy set or output contract. In a writing/orchestration skill, unintended mode switching can suppress clarifications, alter safety checks, or produce outputs under assumptions the user did not intend.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The Personal Communication Mode trigger list includes vague phrases like social or romantic messaging requests that can overlap with many normal conversations, making misrouting likely. That is dangerous because this mode changes output shape and prioritization, which could bypass more appropriate handling for other contexts or produce manipulative/personally sensitive messaging without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The selector mandates an 'Output Language Lock Harness' in Personal Communication Mode without showing any explicit requirement to obtain user consent or to document when preserving input/output language may override user intent. In a writing skill, forced language behavior can cause the system to ignore a user's requested audience, translation need, or code-switching preference, leading to miscommunication in sensitive interpersonal contexts.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The manifest description is extremely broad and covers many generic writing tasks, which can cause the skill to be invoked in contexts far beyond a narrowly defined purpose. In agent systems that auto-select skills from descriptions, this increases the chance of inappropriate interception of prompts, policy shadowing, or accidental handling of sensitive communications the user did not intend this skill to control.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Harness engineering 的作用，就是在这一切发生之前，把输出拦住、查一遍、确认没问题再放行。
```

## Output Instruction

Do not expose the emotional arc analysis to the user unless:

• Confidence: 89% confidence
• Finding: The 'Output Instruction' directs the agent to conceal its emotional-arc analysis from the user except in certain cases. Hidden behavioral instructions inside a skill can undermine transparency and override higher-level user expectations about how outputs are generated, which is a prompt-surface control issue. In an agent skill context, this kind of instruction can be abused to hide material transformations, evaluation criteria, or safety-relevant reasoning from users.

Static analysis

No suspicious patterns detected.