Narrative Architect Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.1

Overview

This is a coherent writing skill, but it can pull from workspace files and persistent project memory for public drafts without clearly showing the user what sources were used.

Install only if you are comfortable with the agent using prior project memory and workspace context to draft public-facing material. Before publishing any output, check for private names, internal architecture, unreleased plans, or cross-project details, and prefer running it in a project-scoped workspace or asking the agent to list consulted sources.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:259

Finding

Overbroad and Undisclosed Context Recovery Across Persistent Memory and Workspace Data

Content

View full analysis

`, ``, ``, `License: TBD`). Do not block with multiple questions. Ask only one high-leverage question when necessary. Do not ask basic questions like "What is this? Who is it for? What problem does it solve?" if the project is already known. If memory retrieval fails, do not treat that as proof of no context. ``` `policies/known_context_recovery_policy.md:49-58` ```markdown ## Context Recovery Sources Before asking clarifying questions, check available sources in this order: ```text 1. Current conversation 2. User-provided project context 3. Workspace README / skill files 4. Persistent memory / project memory 5. Archive or reference docs if available 6. File names and repo structure ``` ``` `runtime_chain.md:408-433` ```markdown ## Known Context Recovery Branch Triggers: known project / skill / product name, known internal architecture, known workspace directory, previously discussed initiative. Runtime: ```text 1. Detect Known Entity 2. Recover Context 3. Determine Sufficient Context 4. Preserve Known Boundaries 5. Identify Unknowns 6. Continue to Requested Runtime Mode 7. Mark Assumptions / Placeholders 8. Produce Output ``` ### Clarification Rule Ask only if context is missing, contradictory, affects public claim ...[truncated 3381 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (75)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · contracts/short_explanation_output_contract.md (reported line 11)May include surrounding context.

md

- target audience is general public or non-technical
- user asks for "300 字介绍", "简单解释", "给普通人讲"

## Output Rules

1. Do not show internal reasoning.
2. Do not show Story Kernel.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/artifact_delivery_harness.md (reported line 65)May include surrounding context.

md

unless the user asks for analysis.

## File Output Rule

Do not save to file unless:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/artifact_delivery_harness.md (reported line 75)May include surrounding context.

md

unless the user asks for analysis.

## File Output Rule

Do not save to file unless:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/language_match_harness.md (reported line 100)May include surrounding context.

md

unless the user asks for analysis.

## File Output Rule

Do not save to file unless:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · runtime_chain.md (reported line 431)May include surrounding context.

md

unless the user asks for analysis.

## File Output Rule

Do not save to file unless:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 88% confidence

Finding

The instruction to withhold the underlying emotional-arc analysis from the user creates a hidden-reasoning/hidden-policy behavior that can obstruct transparency and auditing. In a writing skill, this is less dangerous than direct data exfiltration or command execution, but it can still be abused to conceal manipulative persuasion logic or prevent users from understanding how outputs were shaped.

Content

Scanner excerpt · harness/emotional_resonance_harness.md (reported line 130)May include surrounding context.

Harness engineering 的作用，就是在这一切发生之前，把输出拦住、查一遍、确认没问题再放行。

text

## Output Instruction

Do not expose the emotional arc analysis to the user unless:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/audience_harness.md (reported line 192)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/controlling_idea_harness.md (reported line 175)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/gap_harness.md (reported line 127)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/narrative_authority_harness.md (reported line 248)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/story_harness.md (reported line 139)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · harness/value_stakes_harness.md (reported line 149)May include surrounding context.

md

Then compress or expand depending on the output format.

## Output Instruction

Do not force dramatic gaps into purely factual requests.
If the user asks for a neutral definition, use the gap only as a light explanatory contrast. If the user asks for narrative, pitch, article, or presentation, make the gap explicit.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · harness/public_release_harness.md (reported line 142)May include surrounding context.

md

Hard fail:

1. Output implies unofficial affiliation.
2. Public artifact uses risky third-party name without warning.
3. README starts with internal file tree.
4. Public claims are exaggerated.
5. Output language does not match the artifact.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · policies/dissatisfaction_recovery_policy.md (reported line 34)May include surrounding context.

md

## Dissatisfaction Types

### 1. Clear Context Correction

Examples:

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · policies/output_language_policy.md (reported line 106)May include surrounding context.

md

If language mismatch occurs, regenerate in the correct language while preserving the same substantive content.

Do not apologize at length. Fix the artifact.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Line L05 requires the response to be in Chinese characters, but the file does not offer the user a language choice or explain why a Chinese-only output is necessary. This is a natural-language locale policy concern because it forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The target audience description is written as '普通商业听众' and the document consistently constrains outputs with Chinese examples and phrasing, indicating the skill is intended to respond in Chinese. There is no explicit user opt-in or alternative language choice, which can violate language/locale policy for a generally applicable business-explanation skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cases/regression_tests/GC_NARR_016_RUNTIME_MODE_SELECTION.md (reported line 160)May include surrounding context.

text

reroute communication context
rewrite without asking follow-up

Fail If:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly requires the skill to 'Respond in English' and 'Suggest names in English.' This is a natural-language locale constraint and the file does not indicate that the user is being offered a language choice or that the constraint is justified as region-specific.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cases/regression_tests/GC_NARR_019_PUBLIC_RELEASE_README_DISCIPLINE.md (reported line 89)May include surrounding context.

md

1. README starts with full architecture.
2. README implies unofficial affiliation.
3. README includes UI artifacts.
4. README assumes MIT license without confirmation.
5. README is mostly internal documentation.
6. User value appears only after long methodology sections.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · harness/public_readme_release_cleanup_harness.md (reported line 287)May include surrounding context.

md

1. README starts with full architecture.
2. README implies unofficial affiliation.
3. README includes UI artifacts.
4. README assumes MIT license without confirmation.
5. README is mostly internal documentation.
6. User value appears only after long methodology sections.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly requires the skill to 'Answer in English,' and later states that the latest user language controls delivery. This imposes a language-selection policy rather than offering a user choice, which matches the rule's language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This line explicitly prohibits Chinese output unless the user asks for it, which is a hard language restriction. Because the file frames this as a required behavior rather than an optional preference or justified regional constraint, it constitutes a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Marking 'Output is Chinese' as a fail condition codifies a strict language ban. The document does not present this as a user-selectable preference or region-specific necessity, so it conflicts with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation scope is broad enough to trigger on generic documentation requests such as README or developer documentation, which can cause this skill to activate in contexts beyond its intended niche. In an agent system with multiple skills, overbroad matching can route user requests to the wrong contract, causing inappropriate constraints, misaligned outputs, or suppression of more suitable safety or domain-specific guidance.

Content

No source excerpt is available for this finding.