Security audit

黑石写作助手·中长篇小说版

Security checks for vulnerabilities and agentic risk

Overview

This fiction-writing skill uses local files and optional Blackstone cloud services, but the inspected instructions disclose those actions and generally require user approval.

Install only if you are comfortable with Blackstone's optional cloud story memory, account authorization, feedback submission, and consent-based self-update flow. Keep the default per-action cloud confirmation mode if you want control over what manuscript content leaves your machine, and decline updates or cloud setup if you prefer local-only writing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file gives conflicting instructions about who writes cloud authorization/config: one section says only WorkBuddy auto-merges configuration and other clients require the author to paste config manually, while a later section says the skill should retrieve authorization and write it into local configuration. In a skill with local file access and cloud auth flows, this ambiguity can cause unintended local config modification, writing secrets to the wrong place, or unsafe assumptions about which client may persist credentials.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file instructs the agent to submit user feedback directly to a remote endpoint, including optional bearer authentication and client metadata, even when the user is not connected to the cloud. This creates a real data-exfiltration path from the local skill to an external service that is only loosely related to the core writing function, and the instruction to proceed without credentials increases the chance of silent transmission of user-provided content and environment details.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file gives the skill authority to download, verify, and replace its own skill directory after user approval, which expands the skill from a writing assistant into a software updater. Even with consent and hash checks, this creates a remote code/content supply-chain path: if the update endpoint, manifest, or trust model is compromised, the skill can replace its own behavior with attacker-controlled instructions that later run under the agent's privileges.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: A novel-writing skill is not expected to perform software installation or file replacement, so embedding update/install procedures is an unjustified capability expansion. This mismatch increases risk because users may grant trust based on the writing-assistant purpose while the skill documentation quietly introduces persistent modification of local files and future skill behavior.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger scope is very broad, covering ordinary writing-related requests such as writing fiction, outlining, editing text, continuing chapters, and checking consistency. Overbroad activation can cause unintended invocation of this skill in unrelated contexts, increasing the chance of unnecessary file reads, cloud prompts, or local/remote actions when the user did not explicitly intend to use this particular skill.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Saying that no special command is needed and that any direct statement of writing intent should trigger the skill further expands ambiguous activation. In this skill's context, activation may lead to file operations, version checks, or cloud-account guidance, so unintended routing is more dangerous than for a pure text-only helper.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The guidance says a single natural-language phrase can trigger the skill, including very broad cues like mentioning the skill name or asking to write fiction-related content. In a multi-skill or agent-routed environment, this can cause unintended invocation, context hijacking, or the skill taking over requests that were meant for another tool, especially since it also covers account, billing, and platform-support topics.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The FAQ states that users do not need to explicitly invoke the skill by name and that generic requests about novel writing, outlining, characters, themes, structure, scenes, or style should automatically enter the workflow. This creates an overly broad activation surface, increasing the chance the skill activates on ordinary conversation without clear user consent or appropriate routing boundaries.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instruction that the assistant should automatically judge the user's goal and read the corresponding skill is ambiguous about when activation is appropriate and what limits apply. In a multi-skill environment, this can cause unintended routing, accidental tool use, or silent context switching based on broad interpretation of user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation tells the agent to send feedback content plus client/system metadata to a remote service but does not present a clear user-facing warning that such transmission occurs. Although it says consent is required before submission, it does not clearly disclose the scope of data leaving the local environment, which can mislead users and result in unintentional sharing of sensitive information or device/account context.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation phrase '黑石，开始写作' is intentionally simple, but it is broad enough that normal user conversation or quoted examples may invoke the skill unintentionally. In a writing assistant that can read local files and potentially write content, accidental activation can cause unintended tool use, context switching, or file operations based on ambient text rather than explicit user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The recommended template allows very generic verbs like '开始、设计、分析、写作、续写、修改、润色、检查、保存' without strong trigger constraints. Because these words are common in ordinary discussion about writing, the skill may over-match routine conversation and execute actions, including inspection or persistence of content, when the user was only describing possibilities rather than issuing a command.

Static analysis

No suspicious patterns detected.