super-novel-generator

• Outcome: Pass
• Latest audit: May 28, 2026, 4:36 AM
• Version:
  1.0.1

Overview

This skill is a disclosed Chinese web-novel writing helper that creates project files and continuity notes, with no evidence of hidden data access or exfiltration.

Install only if you want a writing assistant that can create and update local novel project files. Review before using --clean because it removes or resets generated story output, and avoid putting sensitive personal information in .learnings because that content may be reused in later prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to execute a shell script (`./scripts/init-novel.sh`) when certain conditions are met, even though the skill is primarily for content generation. Any instruction that can trigger command execution expands the attack surface: a user could steer the agent into running local scripts in a workspace the analyst has not validated, and the script itself could perform unintended filesystem or environment actions.

VirusTotal

VirusTotal findings are pending for this skill version.