T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/novel_reasoning_check.py:129- Finding
Unpinned Remote Model Code Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
novel-weaver
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate local novel-writing workflow, but its optional model setup can execute unpinned remote code and its filesystem/network permissions are under-disclosed.
Review this before installing. Core writing functions are local and purpose-aligned, but avoid running the optional model install commands unless you are comfortable with unpinned packages, third-party mirrors, and Hugging Face trust_remote_code execution. Use an isolated environment, restrict the skill to its project directory, and be careful with broad auto-activation on ordinary writing requests.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:180- Finding
Unpinned Packages Are Installed from Third-Party Package Indexes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_path_utils.py:21- Finding
Insufficient Path Validation Permits Writes Outside the Project Directory
- Content
View full analysis
- Remediation
View remediation
//data/`. - Pass strict JSON schema validation before use or caching. 4. Validate identifiers with full-match expressions before constructing paths: ```python if not re.fullmatch(r"L\d{2,}", chapter): raise ValueError("Invalid chapter identifier") if not re.fullmatch(r"S\d{2,}", sub_key): raise ValueError("Invalid substructure identifier") ``` 5. Reject absolute identifiers, `.` and `..` components, separators, null bytes, and symlink-based escapes. 6. Recheck containment after combining all path components and before every read or write. 7. Do not persist a path to `.project` until all validation succeeds. 8. Restrict project initialization to generated paths under `DATA_DIR`, or require a separate explicit opt-in for external locations. 9. Use atomic writes with securely created temporary files and avoid truncating a destination until validation has completed. ]]>
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (61)
Tainted flow: 'word_count' from sys.stdin.read (line 331, user input) → subprocess.run (code execution)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
- Content
python # ── 步骤3: state_manager.update-sub — 即时状态标记 ── word_count = len(body.strip().replace("\n", "")) state_manager = SCRIPTS_DIR / "novel_state_manager.py" result = subprocess.run( [sys.executable, str(state_manager), "update-sub", state_path, chapter, sub_key, str(word_count)], capture_output=True, text=True, encoding="utf-8"
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch specifically notes undisclosed model-loading and download-related behavior alongside a supposedly offline writing workflow. Even though the text says model use is optional and local, including package-install and Hugging Face mirror commands in a skill without clearly scoping network/package actions can lead agents or users into executing broader supply-chain-affecting operations than expected.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python {{"dimension": "维度名", "result": "PASS"|"HARD"|"SOFT", "detail": "具体说明(20-50字)"}} 必须包含全部 5 个维度, 仅输出 JSON 数组, 不要有其他文字.""" return prompt def check_reasoning(state_path, chapter, chapter_dir):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to use shell commands, read project state, and write files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a capability/metadata gap: operators and policy layers may assume a lower-risk skill than the runtime behavior actually requires, reducing reviewability and increasing the chance of unintended file or shell access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest trigger list includes broad phrases such as “写文章” and “我想写个故事”, which can match common everyday requests that are not necessarily intended for this specific structured novel-writing workflow. Although negative examples are provided, they do not sufficiently narrow the trigger scope for general writing requests like articles or stories.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is explicitly stateful: it serially writes chapter content, updates project state, caches paths, registers characters, and automatically advances workflow state across sessions. Persistent local state is not inherently malicious, but it is security-relevant because it can retain user content and metadata over time, modify existing projects, and create unintended cross-session data exposure if users do not expect durable storage.
- Content
md - **[强制] 核心规划字段保护 + 串行阻断** — `novel_state_manager.py` 对核心字段做 MD5 指纹校验，LLM 不可更新。context_loader 检测上一子结构是否为 completed，否则 HOOK-BLOCK 阻断。串行写入，一次只改一个子结构 - **[强制] 串行阻断** — context_loader 加载子结构上下文时检测上一子结构 state 是否为 completed。若为 pending 则输出 HOOK-BLOCK 并给出 write-sub 修复命令，强制走管道完成标记后才能继续。子结构写作必须串行 - **[必须] 先确认+规划再写作** — 场景配置和大纲必须经用户确认，每章先 `plan-chapter`（含必填 writing_prompt + 情绪 tone + 可选 emotions）→ 因果链验证 → 通过串行阻断检查，才可开始写作 - **[必须] 写作规范** — 每段 ≤200行（自然段落结束），atomic write 逐行 fsync，正文禁止 `L##S##` 标记行（会被阻断） - **[强制] 写作中登记** — 新角色出场时 `novel_state_manager.py add-char`。**plan-chapter 已加硬阻断**：sub_structures 中出现未登记角色名时 HOOK-BLOCK，必须先 add-char 才能写入。 - **[强制] 每章六检 + 自动完结** — 写完所有子结构后 **write-sub 自动触发 finalize-chapter**（不再需手动执行）：章内连通性 → 跨章承诺链 → 风格校验 → 逻辑检查 → **语义检查** → **推理审核** → 聚合硬性问题并阻断。通过后自动推进 phase。 - **[必须] 全文三检** — 全文完成后必须：`novel_fidelity.py`（大纲忠实度）+ `verify-ending`（结尾收束验证）+ `set-phase stage3_ready`
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is explicitly stateful: it serially writes chapter content, updates project state, caches paths, registers characters, and automatically advances workflow state across sessions. Persistent local state is not inherently malicious, but it is security-relevant because it can retain user content and metadata over time, modify existing projects, and create unintended cross-session data exposure if users do not expect durable storage.
- Content
md - **[强制] 核心规划字段保护 + 串行阻断** — `novel_state_manager.py` 对核心字段做 MD5 指纹校验,LLM 不可更新。context_loader 检测上一子结构是否为 completed,否则 HOOK-BLOCK 阻断。串行写入,一次只改一个子结构 - **[强制] 串行阻断** — context_loader 加载子结构上下文时检测上一子结构 state 是否为 completed。若为 pending 则输出 HOOK-BLOCK 并给出 write-sub 修复命令,强制走管道完成标记后才能继续。子结构写作必须串行 - **[必须] 先确认+规划再写作** — 场景配置和大纲必须经用户确认,每章先 `plan-chapter`(含必填 writing_prompt + 情绪 tone + 可选 emotions)→ 因果链验证 → 通过串行阻断检查,才可开始写作 - **[必须] 写作规范** — 每段 ≤200行(自然段落结束),atomic write 逐行 fsync,正文禁止 `L##S##` 标记行(会被阻断) - **[强制] 写作中登记** — 新角色出场时 `novel_state_manager.py add-char`。**plan-chapter 已加硬阻断**:sub_structures 中出现未登记角色名时 HOOK-BLOCK,必须先 add-char 才能写入。 - **[强制] 每章六检 + 自动完结** — 写完所有子结构后 **write-sub 自动触发 finalize-chapter**(不再需手动执行):章内连通性 → 跨章承诺链 → 风格校验 → 逻辑检查 → **语义检查** → **推理审核** → 聚合硬性问题并阻断。通过后自动推进 phase。 - **[必须] 全文三检** — 全文完成后必须:`novel_fidelity.py`(大纲忠实度)+ `verify-ending`(结尾收束验证)+ `set-phase stage3_ready`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Examples like “帮我检查文章前后是否一致” and “把这几段串起来” are broad enough to apply to ordinary editing or composition assistance, which could cause unintended activation outside the novel-structure domain. The section provides some negative conditions, but it does not clearly bound these triggers to existing novel projects or this skill’s pipeline context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad enough to match very common, generic writing requests such as '写文章' and '我想写个故事', which can cause the skill to activate outside its intended scope. In an agent ecosystem, this increases the chance of unsolicited interception of user prompts, priority hijacking over other more appropriate skills, and accidental application of its strong workflow constraints to unrelated tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file is overwhelmingly written in Chinese and includes multiple user-facing command/help/documentation descriptions, such as Chinese repair notes and workflow guidance. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy violation when no alternative language choice or opt-in is documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is natural-language documentation and begins with a Chinese-only title and continues entirely in Chinese, with no indication that other languages are supported. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该文件标题及全文规范均以中文撰写，并在多处以硬性约束形式规定输出格式、标签和写作内容使用中文表达，例如中文别名标记和中文文风/情绪字段。这构成了对语言/locale 的默认强制，但文档未提供用户选择语言的机制，也未说明该限制仅适用于特定中文项目或地区场景。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L421-L424 说明
novel_atomic_writer.py未检测到【别名】行时会 HOOK-BLOCK 阻断写入；但同一文件前文 L136-L138、L239-L240 已明确写明无别名行时系统会自动补【别名】无，且“不再 HOOK-BLOCK”。这不是简单遗漏，而是对同一写入行为是否阻断的直接矛盾，容易误导开发者和使用者对门禁机制的理解。- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
L428-L434 将别名声明描述为“必须，缺失则阻断写入”，并称 atomic_writer 会拦截该标记行；但文档在 L127-L154 与 L237-L240 中说明 LLM 可不提供别名行，系统会自动补
【别名】无。这会让调用方误以为别名声明是强制人工输出的硬门禁，而实际描述的系统行为并非如此。- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill documentation is written in Chinese, including all questions, explanations, and operational guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy, a skill that forces a specific language without opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.