Liyou Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.0.0

Overview

This is a coherent creative-writing skill, but it asks to automatically modify app and local project data under broad triggers without enough user control.

Install only if you are comfortable with a Chinese-language creative assistant that can update Liyou Claw story/worldbuilding data and local lore files. Treat its automatic sync instructions carefully: review generated chapters and settings before allowing saves or updates, and run the included scripts only on dedicated project folders.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个多功能的动漫 IP 创作助手，涵盖文本创作、设定扩展和图像生成辅助等多个领域；而提供的代码只执行非常狭窄的功能：生成 Stable Diffusion 正负面关键词，并可保存到文件。它没有任何故事生成、章节创作、世界观扩展、设定整理或通用角色设计逻辑。虽然“SD 图像生成关键词优化”与代码行为一致，但这只是声明中的部分能力，不足以支撑其被描述为完整的数字动漫 IP 创作助手。因此描述与实际行为存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 声明描述的是一个面向创作的多功能动漫/IP 内容助手，重点在生成与创作支持；而代码仅实现了小说章节文件的整理、统计和目录生成，属于狭义的本地文档管理/编排工具。虽然描述中提到“整理设定”与“小说章节创作”与该代码领域相关，但实际行为并不进行内容创作，也不覆盖角色设计、图像关键词优化、世界观扩展等核心宣称能力，因此描述与实际代码存在明显不匹配。

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

# 组合提示词
    prompt = ", ".join(prompt_parts)
    
    return prompt


def generate_negative_prompt() -> str:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill instructs the agent to read and update local files, but it does not declare any explicit tool scope or permission boundaries. This creates a mismatch between documented capabilities and authorization controls, increasing the chance of unintended file access or writes if the runtime grants broad defaults.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Very broad trigger phrases increase the chance that ordinary creative conversation will activate the skill unexpectedly. In a skill that can read files and potentially update local or external state, accidental invocation can lead to unauthorized context access or unintended actions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The novel-creation triggers are vague and can match common conversation patterns, making unintended activation plausible. Because the workflow includes reading progress files and later saving updates, ambiguous triggering can expose local content or prepare unintended state changes.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The worldbuilding section says the skill may trigger when new entities are merely mentioned during discussion, which is an especially broad contextual rule. Since this workflow includes automatic synchronization and local database updates, normal brainstorming could unintentionally cause persistent data changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as a creative assistant, but the instructions direct automatic synchronization to an external application and local knowledge files through write-capable interfaces. Hidden or under-emphasized data modification behavior can cause unintended updates to application state and stored content without informed user consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes automatic synchronization to the app and local updates without sufficiently warning that user data will be changed. Lack of clear change warnings undermines informed consent and increases the risk of silent or mistaken modification of persistent content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The principle of prioritizing automatic synchronization and requiring no manual operation encourages writes by default rather than consent by default. In a skill with content-management capabilities, this design pattern makes accidental persistence and data corruption more likely.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documented script usage shows processing of arbitrary Windows file paths, which expands the skill from content creation into broad local file-system operations. If invoked in an agent environment with host access, this could expose or modify unrelated user files beyond the intended skill workspace.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file is written entirely in Chinese and presents the character/specification content as the default format, with no indication that other languages are supported or that the Chinese-only requirement is optional. Under the policy rule for language/locale constraints, this can be a natural-language policy violation when no user opt-in or justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire skill file is written in Chinese and all example phrases, headings, and templates assume Chinese output, but there is no indication that language selection is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The entire skill document is written only in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for natural-language violations, a fixed language without opt-in or justification can be a locale-policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains natural-language documentation and CLI help oriented entirely to Chinese-speaking users, starting with the module docstring and continuing through usage examples. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: L003 的整体描述完全以中文定义技能用途和使用场景，且文档未说明是否支持根据用户偏好切换语言。对于组织语言/locale 策略而言，这可能构成默认强制特定语言而缺少显式用户选择。

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: Manifest 主要描述本地创作相关用途，如角色设计、小说编写、设定整理，并未提及联网检索或外部资料研究。L066 要求执行 web_search 搜索最新资料，这是新增的外部信息获取能力，与描述存在范围差异。

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown template forces a specific language/locale for all users through its headings, prompts, and instructional text. Under the policy, locale-specific language is acceptable only when the skill offers user choice or clearly documents a justified regional constraint, neither of which appears here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The entire template, including headings and fixed closing text, is written in Chinese and implicitly requires generated content to follow that language. Under the policy rule, a fixed language requirement without user opt-in or documented regional justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy criteria, a skill that implicitly enforces a specific language without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructional content in Chinese and does not indicate that the language is optional, selectable, or justified as a region-specific document.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The save routine calls Path(output_path).stat().st_mtime before writing the file, which will raise an exception if the target file does not already exist. Because --output is user-controlled, an attacker or normal user can reliably trigger a denial of service for the save path by providing a new filename, preventing the skill from completing its intended action. In this creative-assistant context the impact is limited to availability and reliability rather than confidentiality or code execution.

Static analysis

No suspicious patterns detected.