ZF-novel-writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.1

Overview

This novel-writing skill is mostly purpose-aligned, but it ships maintenance scripts that can silently rewrite hard-coded OpenClaw story files outside the active book context.

Install only if you are comfortable with a writing assistant that can spawn sub-agents and modify local novel project files. Before use, remove or fix the hard-coded maintenance scripts, require explicit book paths, add backups/dry-run confirmation for archive and canon updates, and avoid relying on the advertised publishing feature unless it is separately documented and permissioned.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: tools/update_canon.py:7

Finding

Import-Time Overwrite of a Hard-Coded OpenClaw Canon File

Content

View full analysis

Vulnerability Details

File Location: tools/update_canon.py, lines 7-8 and 90-91
Vulnerability Type: Hard-coded persistent file modification executed at module import
Risk Level: Medium
AI Agent Skill Risk Classification: T09: Insecure Skill Coding Practices

Vulnerable Code

python

with open('C:/Users/huang/.openclaw/workspace/story/meta/canon_bible.json', 'r', encoding='utf-8') as f:
    data = json.load(f)

python

with open('C:/Users/huang/.openclaw/workspace/story/meta/canon_bible.json', 'w', encoding='utf-8') as f:
    json.dump(data, f, ensure_ascii=False, indent=2)

Technical Analysis

The script reads and overwrites a developer-specific file under a persistent OpenClaw workspace. The target path is not supplied or approved by the user, is not derived from the active book, and is not validated against an authorized project root.

All processing is performed at module scope rather than inside a guarded entry point. Consequently, merely importing tools.update_canon executes the complete mutation. The script inserts fixed chapter-four setup and payoff records into the selected canon file and then rewrites it directly. It does not create a backup, use a temporary file, perform atomic replacement, or validate the complete document before committing the change.

Attack Path

1. A user, agent, test harness, or another module imports or directly executes tools.update_canon.
2. Python immediately opens the hard-coded OpenClaw canon file.
3. The script inserts its fixed chapter-four records and recalculates continuity fields.
4. The original file is overwritten without user confirmation or project-selection validation.
5. Subsequent writing sessions consume the modified persistent state, potentially propagating incorrect canon information into later chapters.

No attacker-controlled privilege escalation is demonstrated. Exploitation is limited to the filesystem permiss ...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

• Move all executable behavior into a main() function protected by if __name__ == "__main__":.
• Require an explicit --canon-file or --book-dir argument rather than using a developer-specific path.
• Resolve the requested path and verify that it remains under an approved books directory.
• Validate the JSON structure and required continuity fields before changing any values.
• Remove fixed chapter-specific records from the reusable utility and accept update data through validated input.
• Add a dry-run mode that displays the proposed changes.
• Require explicit confirmation before modifying an existing canon file.
• Write the new document to a temporary file in the destination directory, flush and synchronize it, and then atomically replace the destination.
• Create a timestamped backup before committing persistent changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: tools/update_pending_setups.py:8

Finding

Import-Time Mutation of Pending Setup State at a Hard-Coded Path

Content

View full analysis

Vulnerability Details

File Location: tools/update_pending_setups.py, lines 8-12 and 47-48
Vulnerability Type: Uncontrolled import-time modification of persistent state
Risk Level: Medium
AI Agent Skill Risk Classification: T09: Insecure Skill Coding Practices

Vulnerable Code

python

canon_file = Path("C:/Users/huang/.openclaw/workspace/story/meta/canon_bible.json")

with open(canon_file, 'r', encoding='utf-8-sig') as f:
    canon = json.load(f)

python

with open(canon_file, 'w', encoding='utf-8') as f:
    json.dump(canon, f, ensure_ascii=False, indent=2)

Technical Analysis

This maintenance module selects a fixed canon file from a specific user's OpenClaw workspace and rewrites its continuity state. It does not verify that the target belongs to the active project or that the caller intended to update it.

The entire operation is at module scope. Importing the module therefore recalculates pending_setups and setup_health and overwrites the persistent canon file. Direct truncating writes are used without backup or atomic replacement. An exception, interruption, or storage failure during serialization could leave the file incomplete.

Attack Path

1. An agent or local component imports tools.update_pending_setups, possibly while discovering or testing utilities.
2. Import execution opens the fixed .openclaw/workspace/story/meta/canon_bible.json file.
3. The module recalculates pending setup and health fields according to its internal assumptions.
4. It truncates and rewrites the selected file without requesting approval.
5. Future sessions load the altered continuity state and may omit or misclassify story setups.

The attack requires the process account to have write permission to the hard-coded file. The code does not bypass filesystem permissions or elevate privileges.

Impact Assessment

Successful invocation can modify or corrupt persistent conti ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Place the update logic in a function and invoke it only from a guarded command-line entry point.
• Require the canon path as an explicit argument.
• Reject paths outside a configured and resolved books root.
• Verify that the selected canon file corresponds to the active book.
• Validate setup and payoff records against a defined schema before recalculation.
• Support --dry-run and show a structured diff before writing.
• Preserve a backup of the previous document.
• Serialize to a same-directory temporary file and use atomic replacement only after successful validation.
• Add error handling that preserves the original file if parsing, validation, or serialization fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: tools/setup_structure_upgrade.py:209

Finding

Hard-Coded Destructive Canon Migration Without Target Validation

Content

View full analysis

Vulnerability Details

File Location: tools/setup_structure_upgrade.py, lines 209-215 and 270-272
Vulnerability Type: Unsafe in-place migration of a fixed persistent file
Risk Level: Medium
AI Agent Skill Risk Classification: T09: Insecure Skill Coding Practices

Vulnerable Code

python

def main():
    """Main function"""
    canon_file = Path(r'C:\Users\huang\.openclaw\workspace\story\meta\canon_bible.json')

    with open(canon_file, 'r', encoding='utf-8') as f:
        canon = json.load(f)

python

with open(canon_file, 'w', encoding='utf-8') as f:
    json.dump(canon, f, ensure_ascii=False, indent=2)

Technical Analysis

The migration tool is protected by a main() entry-point guard, so importing it does not trigger the write. However, running it always targets one developer-specific OpenClaw canon file. The user cannot select or verify the target through command-line arguments.

The migration removes entries considered duplicates, reclassifies setup records, replaces pending_setups, and recalculates health data before directly overwriting the source. These are destructive transformations. The tool provides no dry-run mode, confirmation, schema validation, backup, transaction boundary, or atomic replacement.

Attack Path

1. A user or orchestrating agent invokes tools/setup_structure_upgrade.py, believing it will operate on the current book.
2. The script ignores the active project and selects the hard-coded workspace path.
3. Its migration logic removes duplicate records and rewrites classification and pending-state fields.
4. The source file is truncated and replaced in place.
5. Incorrect deduplication or an interrupted write causes permanent state loss or malformed canon data.
6. Later writing and planning operations consume the altered file.

Exploitation does not grant additional system privileges; it relies on the invoking process already having w ...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the hard-coded path with a required --canon-file or --book-dir argument.
• Resolve and validate the target against an approved books root before reading or writing.
• Display the resolved target and require confirmation unless a deliberate noninteractive flag is supplied.
• Implement a dry-run mode that reports removed, reclassified, and regenerated records.
• Validate both the original and migrated documents using a strict schema.
• Preserve unknown fields and reject ambiguous duplicate records instead of silently deleting them.
• Create a timestamped backup before migration.
• Write the migrated document to a temporary file, verify that it can be parsed, and atomically replace the original.
• Record the migration version and a reversible change log.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (65)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A local JSON maintenance/update script presented as a full writing platform is a risky mismatch because it can modify project metadata while benefiting from trust granted to a different use case. Hidden state mutation is particularly concerning in a skill that claims to 'handle everything automatically.'

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tools/canon_generator.py (reported line 289)May include surrounding context.

python

}}
}}"""
        
        return prompt
    
    def _parse_response(self, response: str) -> Optional[Dict]:
        """解析AI返回的JSON"""

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tools/simple_writer_enhanced.py (reported line 553)May include surrounding context.

python

}}
}}"""
        
        return prompt
    
    def _parse_response(self, response: str) -> Optional[Dict]:
        """解析AI返回的JSON"""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs the Orchestrator to update canon_bible.json, create summary files, move chapter files, and delete the temp file, but it does not require explicit user confirmation or warning before modifying or deleting user content. In an agent skill, these are state-changing filesystem operations that can cause unintended data loss or silent alteration of project files, especially if the agent is triggered broadly or operates on the wrong book/chapter context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README specifies activation using the Chinese phrase "写小说" or the command "/novel", while the skill title and instructions emphasize Chinese usage. Because there is no explicit statement that users may choose their preferred language or locale, this may constitute a language-policy issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents file-reading and file-writing behavior but does not declare any explicit tool scope or allowed-tools boundary. In a host environment that honors manifest scoping, this weakens least-privilege controls and can let a creative-writing trigger invoke filesystem actions without clear operator awareness.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 86% confidence

Finding

A trigger phrase that shadows a built-in command increases the risk of accidental routing to this skill instead of the expected native action. Because this skill claims autonomous planning and file modifications, trigger collision can cause unintended execution in contexts where the user merely wanted ordinary writing help.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad triggers like 'write novel' and generic chapter-generation phrases can collide with ordinary user requests and cause unintended activation. In a skill that performs file operations and claims automation, accidental invocation increases the chance of unexpected filesystem changes or confusing behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Advertising an automatic publishing script is a red flag because publishing is materially higher impact than writing assistance and is unrelated to the declared core workflow. It implies possible exfiltration, account interaction, or irreversible external actions that are not properly scoped or explained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.