Webnovel Serial Pipeline

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:08 PM UTC
• Version: 0.1.4

Overview

The skill appears to be a legitimate Korean web-novel publishing helper, but its file-writing scripts are under-scoped and can write outside the intended draft or Quartz folders if given crafted inputs.

Install only if you trust the operator and will pass conservative, normal series and slug values. Before use, the publisher should add filename validation, containment checks under the configured draft and Quartz roots, and an explicit overwrite policy. The artifact does not show malicious exfiltration or persistence, but the filesystem write boundaries need review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publish_episode.py:56

Finding

Path Traversal and Arbitrary File Write During Episode Publishing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/new_episode.py:19

Finding

Path Traversal and Arbitrary File Overwrite During Draft Creation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a content-production and publishing pipeline for a Korean web-novel site. The supplied code instead implements a security/prepublish validation script that recursively scans repository files for private key signatures and suspicious strings such as webhook/pastebin references, curl/wget/powershell usage, and known threat markers. This is a materially different primary purpose from generating covers, converting media, producing episode markdown, linting, or publishing a Quartz-hosted serial. While a prepublish check could be a supporting detail in some workflows, the declared description does not mention any security-scanning capability, and this code chunk is specifically focused on that unrelated function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a full web-novel production and publishing pipeline, including cover creation, image conversion, markdown generation, linting, and publishing, and explicitly mentions Nano Banana Pro and ffmpeg. This code chunk only acts as a post-review publishing wrapper: it validates arguments, derives Quartz paths, then runs publish_episode.py and sync_index.py. There is no evidence here of cover generation, WebP processing, draft creation, or use of Nano Banana Pro/ffmpeg. While publishing is part of the declared purpose, the actual code's primary function is narrower and includes a specific review-confirmation trigger not captured in the declaration. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/prepublish_check.py (reported line 4)May include surrounding context.

python

#!/usr/bin/env python3
"""Pre-publish security check for ClawHub.

Scans for obvious private keys + common exfil/social-engineering markers.

Run from the skill folder:
  python3 scripts/prepublish_check.py

SECURITY NOTE FOR ANTIVIRUS SCANNERS:
This file contains regex patterns to DETECT malicious code, not to EXECUTE it.
The patterns below are used to PREVENT malware from being published to ClawHub.
This is a security feature, similar to antivirus signature databases.
"""

from __future__ import annotations

import re
from pathlib import Path

SKILL_DIR = Path(__file__).resolve().parents[1]

# SECURITY NOTE: These patterns are used to DETECT threats, not create them.
# Similar to antivirus signature da

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises shell, file read, and file write behaviors but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing least-privilege declarations increases the chance that the skill can be invoked with broader-than-necessary capabilities, making unintended file modification or command execution more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The description explicitly defines the skill as building and publishing a Korean web-novel serial, which sets a specific language/locale expectation. Because the file does not offer an alternate language option or explicit user opt-in for this constraint, it can violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script requires a 'korean slug' and later generates fixed Korean body text and a 'lang-ko' tag, which enforces a specific language/locale in the output. This matches the policy concern for language constraints without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/publish_episode.py (reported line 36)May include surrounding context.

python

def run_lint(lint_script: Path, file: Path) -> None:
    proc = subprocess.run(["python3", str(lint_script), "--file", str(file)])
    if proc.returncode != 0:
        raise SystemExit(proc.returncode)

Tainted flow: 'new_text' from pathlib.Path.read_text (line 66, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/sync_index.py (reported line 67)May include surrounding context.

python

_, post = rest.split(END, 1)

    new_text = pre + START + between + END + post
    index_file.write_text(new_text, encoding="utf-8")
    print(index_file)

Static analysis

No suspicious patterns detected.