Github Novel Serialization

• Outcome: Review
• Latest audit: Sep 22, 2026 · 12:09 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a disclosed novel-writing workflow, but its GitHub publishing setup asks for broader write permissions than needed and uses very broad activation triggers.

Review before installing in a repository that can publish publicly. Remove the unnecessary packages: write permission from the workflow, require an explicit confirmation before tag/push/release actions, and be aware that generic writing prompts may activate the skill even when you only wanted casual writing help.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Hidden Instructions

High

• Category: Prompt Injection

Content

## Description of Changes

<!-- Describe the changes you made -->

## Affected Module(s)

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

.claude/
.copilot/
.agents/
.env
.env.local

# Logs

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.copilot/
.agents/
.env
.env.local

# Logs
*.log

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.claude/
.copilot/
.agents/
.env
.env.local

# Logs

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.copilot/
.agents/
.env
.env.local

# Logs
*.log

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Hidden Instructions

High

• Category: Prompt Injection

Content

> ```markdown
> ## Description of Changes
>
> <!-- Describe the changes you made -->
>
> ## Affected Module(s)
>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The root skill description uses very broad triggers like writing novels, creating characters, building worlds, drafting chapters, and publishing, which overlap with many ordinary creative-writing requests. In agent ecosystems that auto-select skills from natural-language descriptions, this can cause unintended invocation, exposing repository-writing or publishing guidance in contexts where the user only wanted simple writing help.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Several module trigger phrases are everyday requests such as 'create character,' 'write chapter,' or 'update state' without requiring project, repo, or continuity-management context. This increases the chance of over-broad module activation and unintended access to publishing, state-management, or repo-oriented instructions in unrelated chats.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The workflow requests `packages: write` even though the described release process only creates GitHub releases for chapter files and documentation. Excess token permissions in GitHub Actions enlarge blast radius if the workflow, an action dependency, or repository contents are compromised, enabling unintended package publication or package registry tampering.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README presents GitHub publishing as part of the normal workflow but does not clearly warn that publishing can create tags, releases, or otherwise modify a repository. In an agent setting, unclear boundaries around write-capable operations increase the chance of unintended repository changes if a user asks for help in general terms.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This markdown file explicitly says users can 'use any trigger phrase' and then provides plain-language examples like 'Build a world' and 'Write Chapter 1,' without defining boundaries for when the skill should or should not activate. Those phrases are common creative-writing requests and the document gives no negative examples or scope constraints to prevent unintended invocation.

Session Persistence

Medium

• Category: Rogue Agent

Content

```
# Clone the repository into your project's .github/skills directory
mkdir -p .github/skills
git clone https://github.com/[OWNER]/github-novel-serialization-skill.git .github/skills/github-novel-serialization-skill
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

cd github-novel-serialization-skill

# Create a symlink in your Claude Code skills directory
mkdir -p ~/.claude/skills
ln -s $(pwd) ~/.claude/skills/github-novel-serialization-skill
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are very generic creative-writing commands such as 'write chapter' and 'continue story', which can cause the skill to activate in situations where a user did not specifically intend to invoke this module. In an agentic environment, unintended activation can lead to incorrect workflow routing, unnecessary file generation, or accidental state updates in adjacent novel-writing modules, though it does not directly introduce code execution or data exfiltration risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The phrase "track timeline" is ambiguous because it lacks domain constraints and could be interpreted as applying to general scheduling, project planning, or other non-novel requests. While less risky than direct state mutation triggers, it still increases the likelihood of accidental skill selection and inappropriate handling of user intent.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file instructs that all generated novel content 'MUST' be written in {{OUTPUT_LANGUAGE}} and sets a default value of English. This is a natural-language locale policy constraint, and the template does not provide an explicit opt-in mechanism or user-facing choice at runtime beyond manual placeholder replacement.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The prompt states that all generated novel content must be written in {{OUTPUT_LANGUAGE}} and assigns a default value of English. This creates a language policy constraint that is applied unless the user changes the template, rather than explicitly offering a runtime language choice or opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The report section instructs the model to produce the quality report in {{OUTPUT_LANGUAGE}}, which imposes a locale/language requirement. Because the file defaults that variable to English elsewhere and does not require explicit user consent at execution time, this can violate the language-choice policy.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: This markdown file includes natural-language text about an 'Improved runtime output language specification.' In the absence of any indication that language selection is optional or justified by a region-specific purpose, this can suggest a language/locale constraint that may conflict with the policy requiring user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Lines L246-L247 state that all infrastructure files MUST be in English for universal compatibility. This is a natural-language locale policy that forces a specific language choice, and the document does not present it as optional or provide a documented region-specific justification.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: The phrase "track timeline" is ambiguous because it lacks domain constraints and could be interpreted as applying to general scheduling, project planning, or other non-novel requests. While less risky than direct state mutation triggers, it still increases the likelihood of accidental skill selection and inappropriate handling of user intent.

Static analysis

No suspicious patterns detected.