Security audit
Security checks for vulnerabilities and agentic risk
This novel-writing skill needs review because its release automation has a command-execution flaw and can publish chapters without enforcing their approval.
Fix the release workflow before enabling it: validate tag names, pass tag text through a quoted environment variable, and reduce token permissions. Review the exact chapter attachments and actual editorial approvals before pushing a release tag. Only paste unpublished manuscripts into AI services you have chosen to trust.
.github/workflows/novel-release.yml:130Git tag name is interpolated directly into shell source
Arbitrary commands execute on the release runner. The workflow grants contents: write and packages: write at lines 9–11, and checkout at lines 17–18 retains credentials by default, exposing repository write credentials to injected commands.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
$(DEV) scaffold --name "$(NAME)" --root "$(ROOT_DIR)"
clean:
rm -rf .workbuddy/.pytest_cache
find . -name __pycache__ -type d -prune -exec rm -rf {} +
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.claude/
.copilot/
.agents/
.env
.env.local
# Logs
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.copilot/
.agents/
.env
.env.local
# Logs
*.log
The supplied chunk implements repository hygiene tooling rather than novel-writing orchestration, narrative continuity verification, or GitHub publishing. Although hygiene checks could support a publishing workflow, this script independently audits a broad local directory tree and optionally modifies matching files, capabilities not represented in the declared description. It contains no AI integration, narrative analysis, or GitHub interaction. This assessment is limited to the supplied chunk.
The supplied code primarily launches developer checks through subprocesses. It does not implement AI-assisted writing, character or world creation, chapter continuity verification, or GitHub publishing. Its scaffold command is related to novel-project setup, but the dominant functionality is development tooling, making this a material primary-purpose mismatch. No malicious behavior or external data transmission is evident; the delegated scripts' internal behavior is not shown.
The supplied chunk primarily tests a repository hygiene utility and contains no writing, character development, world-building, narrative continuity, or GitHub publishing functionality. Such checks could support a publishing workflow, but this chunk establishes no integration with that workflow; its demonstrated purpose is materially different. File changes shown are limited to test fixtures, and the scanner implementation itself is not supplied.
Referenced artifact was not completely inspected
both forms are supported), and keeps lexical sort equal to numeric sort. See `references/subproject-playbook.md` Section 2.
Referenced artifact was not completely inspected
> `references/subproject-playbook.md` Section 3 (timeline inside `worldbuilding/`, character state
Referenced artifact was not completely inspected
- **Subproject Playbook**: `references/subproject-playbook.md` — field-tested layout, decision ledger, report indexing, layered memory, hygiene. **Where it disa
Referenced artifact was not completely inspected
d files are exempt **but must be declared** via `scan_hygiene.py --allow`. See `references/subproject-playbook.md` Section 10.
Referenced artifact was not completely inspected
- **Shared Scripts**: `scripts/README.md` — catalog and invocation conventions for `humanizer_check.py` (de-AI-tone gate), `_list_hits.py`, `_promote_draft.py`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- 改动一律**先进子项目草稿**（`notes-personal/`），草稿 `humanizer_check.py` 通过且审核通过后，才允许用 `_promote_draft.py` 同步进 `chapters/` 定稿。
- 送审走**三审制度**：`review_all.py --stage first`（初审·责任编辑）→ `--stage second`（复审·编辑部主任）→ `--stage final`（终审·主编签发），每审次各出一份带独立签字栏的报告，全部归档到 `.workbuddy/reports/`。审次单向流转，任一 `FAIL` 退回上一环节；**终审未签发（或 FAIL 未清零）不得 promote**。
- `_promote_draft.py` 默认执行 humanizer 自检，FAIL 拒绝同步；`--force` 为例外通道，`--no-check` 不推荐。
- 纯勘误（错别字、标点、繁简、断行）可直改定稿并用 `_sync_draft.py` 回写草稿。
## 新增子项目脚本
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
|---|---|---|
| `humanizer_check.py` | 去 AI 痕迹自检：AI 腔词密度、结构套话与抽象评价、模糊副词、情绪标签、套路句式、章末升华、成语连用、破折号/省略号/感叹号密度、段长变异系数；按 PASS / WARN / FAIL 分级 | `<文件或目录>`、`--out <报告.md>` |
| `_list_hits.py` | 列出待改写的命中句（人工改写前取句） | `--kind banned/pattern/vague/emotion/idiom/dash`、`--target <路径>`、`--limit N` |
| `_promote_draft.py` | 草稿 → 定稿（release）同步：按章号整块写入、写前快照 `_trash/定稿同步前_<日期>/`、字数前后对比、章标题零差异校验、humanizer 门禁（FAIL 拒绝同步） | `<章号...>`、`--root`、`--draft`、`--dry-run`、`--report`、`--no-check`、`--force` |
| `_sync_draft.py` | 定稿 → 草稿回写（**仅勘误**，不得作常规改动通道） | `<章号...>` |
| `review_all.py` | **综合审稿**：跑门禁并输出审核报告（对象／结论表／问题明细／规模概览／待办清单／签字栏）；`--stage` 按三审制度分阶段（`first` 初审＝humanizer+scale+punctuation／`second` 复审＝continuity+rationality／`final` 终审＝全维回归+签发），各审次出独立签字栏；不带 `--stage` 为一次跑全部（旧行为） | `--batch`、`--stage`、`--chapters`、`--draft`、`--target`、`--skip`、`--out` |
| `review_scale.py` | **规模审查**：每章字数、达标率、缺口、分布区间与缺口 TOP（供分批扩写排序） | `--target`、`--max`、`--chapters`、`--draft`、`--out` |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
python "../GitHub Novel Serialization Skill/scripts/_promote_draft.py" 031 --dry-run # 只看差异，不落盘
python "../GitHub Novel Serialization Skill/scripts/_promote_draft.py" 031 --report .workbuddy/reports/xxx.md
python "../GitHub Novel Serialization Skill/scripts/_promote_draft.py" 031 --root "C:/Users/Admin/-1928"
python "../GitHub Novel Serialization Skill/scripts/_promote_draft.py" 031 --no-check # 跳过 humanizer 自检（不推荐）
python "../GitHub Novel Serialization Skill/scripts/_promote_draft.py" 031 --force # humanizer 非 PASS 也强制同步
前提：草稿改动已通过审核（§9.1 第 1—4 步）。未过审的改动不得进定稿。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
ap.add_argument('--draft', default=DRAFT_DEFAULT)
ap.add_argument('--dry-run', action='store_true')
ap.add_argument('--report', default='', help='审核报告路径（记入同步日志）')
ap.add_argument('--no-check', action='store_true')
ap.add_argument('--force', action='store_true')
ap.add_argument('--root', default='', help='子项目根目录（默认当前工作目录，须含 chapters/ 与 notes-personal/）')
a = ap.parse_args()
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
ap.add_argument("--scripts", default="../GitHub Novel Serialization Skill/scripts",
help="relative path to the shared scripts directory")
ap.add_argument("--owner", default="OWNER", help="GitHub owner, used in generated links")
ap.add_argument("--force", action="store_true", help="overwrite existing files")
ap.add_argument("--dry-run", action="store_true", help="print the plan, write nothing")
args = ap.parse_args(argv)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.claude/skills ln -s $(pwd) ~/.claude/skills/github-novel-serialization-skill
### For Cursor / Other Agents
The purported continuity check only tests whether a documentation file exists; it never validates chapter content and does not fail when the module is missing. This creates a fail-open publication gate that can release unchecked content despite the skill's explicit requirement that every chapter pass verification.
The release action attaches every matching chapter rather than only the chapter approved for a particular release. In a serialization workflow this can distribute future or unapproved chapters unintentionally; the exposure depends on repository visibility and existing access, and does not bypass private-repository permissions.
Without declared permissions the skill's intent is opaque and cannot be validated.
The Quick Start explicitly instructs the agent to push to a repository, rather than merely listing a tool capability. The skill does not warn that this sends local release data to a remote host and may expose it to others depending on repository visibility.
The template instructs users to paste it into third-party AI chat services, with the full draft and continuity notes supplied as inputs (L040–L064). It provides no warning that unpublished manuscripts or confidential notes will be shared with the selected provider and handled under that provider's data policies.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def humanizer_pass(path):
r = subprocess.run([sys.executable, HUMANIZER, path],
capture_output=True, text=True, encoding='utf-8')
out = r.stdout or ''
m = re.search(re.escape(os.path.basename(path)) + r'.*?\*\*(PASS|WARN|FAIL)\*\*', out, re.S)
L032–L034 explicitly state that backtick paths are documentation rather than links and are listed without judgment. However, L313–L316 convert only existing targets to BARE, retaining MISSING and NONRELEASE classifications for other backtick paths; these can fail the check through --fail-on (L405–L411), including the documented invocation at L059.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd: list, label: str) -> int:
print(f"\n--- {label} ---")
print("$ " + " ".join(f'"{c}"' if " " in c else c for c in cmd))
proc = subprocess.run(cmd, cwd=str(ROOT))
if proc.returncode == 0:
print(f"[ok] {label}")
else: