Liyou Setting Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it should be reviewed because it can automatically persist changes to local novel and worldbuilding files from normal discussion without clear confirmation.

Install this only if you want the agent to automatically save and update your novel and worldbuilding records while you discuss them. Use backups or a disposable project first, because ordinary plot brainstorming may create or modify persistent local character and chapter data without a separate confirmation step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74
• Finding: Automatic Persistent Data Modification Without Explicit User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 74-76 **Vulnerability Type**: Automatic persistent writes and unsafe default behavior **Risk Level**: Medium **Relevant snippet (English rendering of the audited instructions):** ```markdown 2. Character automatic synchronization rule: When the user discusses a plot and mentions a new character or creature's name, identity, abilities, background, or other information, automatically call `addSettingSubItem` to add it to the creature list (`panelKey="11"`). If the character already exists, automatically call `updateSetting` to update the corresponding sub-item. If information is incomplete, the user may be asked to confirm before saving. 3. Novel automatic saving rule: When the user discusses a novel plot or requests a novel chapter, automatically call `saveNovelChapter` to save the generated chapter to the novel workshop. When the user says to add text to a chapter or modify a chapter, automatically call `updateNovelChapter` to update it. After saving, notify the user that it was saved. 4. All modifications are automatically saved to local files and remain after restart; no manual action is required. ``` ### Technical Analysis The Skill directs the Agent to perform durable write operations merely because a user discusses plot details, mentions a character, or requests generated prose. It does not consistently require an explicit save request or confirmation before invoking `addSettingSubItem`, `updateSetting`, `saveNovelChapter`, or `updateNovelChapter`. The optional statement that the Agent may request confirmation when information is incomplete does not protect complete-looking but unverified information. Existing character records or chapters can therefore be modified automatically. Because the resulting changes are saved locally and survive restarts, an incorrect interpretation can become persistent application state. This behavior violates secure-default and least-si ...[truncated 1563 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before every persistent create or update operation. 2. Treat ordinary plot discussion and prose generation as non-persistent drafts by default. 3. Before invoking a write tool, display the target panel, character, or chapter and summarize the proposed changes. 4. Distinguish explicit commands such as “save,” “create,” or “update” from conversational references that do not authorize storage. 5. For updates, retrieve and verify the intended existing record before replacement to avoid modifying similarly named entities. 6. Add revision history, backups, or transactional rollback for character and chapter updates. 7. Prefer patch-based updates over complete-content replacement where supported. 8. Notify the user only after the tool confirms success, and provide a clear undo mechanism. 9. Define retention controls so users can review and delete automatically or accidentally stored content.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to automatically modify settings and save content to local files without requiring explicit user confirmation at the moment of the write. That creates a real integrity risk: normal conversational discussion about plots or characters could trigger unintended persistent changes, especially because the rules say to 'directly call' write functions and 'automatically save' results.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language instructions and examples are entirely in Chinese, and the file does not indicate that the skill supports other languages or that use of Chinese is an intentional, justified locale constraint. Under SQP-3, forcing a specific language without user opt-in can be a policy issue.

Static analysis

No suspicious patterns detected.