Story Chain Multiverse

• Outcome: Pass
• Latest audit: May 28, 2026, 10:04 AM
• Version:
  1.0.0

Overview

This is a Chinese interactive storytelling skill with optional adult story branches, but it does not try to run code, access accounts, or send data.

Install this only if you want a Chinese-language interactive fiction assistant. Be aware it may activate on general story or roleplay prompts, and it includes optional adult/R18 story paths that should only be used in appropriate contexts with explicit user intent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file introduces an adult/情色/R18 story branch that is not disclosed in the skill manifest, creating a capability mismatch between declared and actual behavior. This is dangerous because downstream platforms, reviewers, or safety controls may permit the skill as a general story tool while users can access sexual content through hidden or opt-in prompts, including potentially inappropriate exposure if age-gating and policy checks are absent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match ordinary chat such as asking to continue a story or roleplay, which can cause the skill to activate when the user did not clearly intend to enter this mode. In this skill, that matters more because it can steer the conversation into extended roleplay flows and even expose optional adult-themed branches, creating consent, routing, and safety-boundary problems.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: Mandating Chinese output without checking the user's language preference can cause the system to respond in a language the user does not understand, increasing the risk of confusion about instructions, choices, and content boundaries. In an interactive storytelling skill, that confusion can weaken meaningful consent and make it harder for users to recognize or decline sensitive content paths.

VirusTotal

65/65 vendors flagged this skill as clean.