Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese novel-writing skill that writes story drafts and memory files locally, with a reset option that can delete prior generated Markdown files.
Install only if you want a Chinese-language web-novel workflow that stores drafts and story memory in local output/ and .learnings/ paths. Avoid running init-novel.sh with --clean unless you are comfortable deleting prior generated Markdown files and resetting memory files, and keep those paths out of version control if the story material is private.
The documented purpose promises end-to-end novel generation, review, memory, and export workflows, but the actual implemented behavior appears limited to local file manipulation such as chapter Markdown formatting and batch processing. This mismatch is dangerous because users may consent to a harmless-seeming writing assistant while actually invoking file-system actions with broader operational impact than disclosed.
The script performs a destructive rm -rf during cleanup, and while the path components are quoted, the command still deletes matching files in a shared output directory with no confirmation or project isolation. In a skill context where agents may invoke tools with user-influenced parameters, destructive filesystem operations increase the risk of accidental or unintended deletion of prior work.
if [ "$CLEAN" = true ]; then
log_step "清除旧的输出文件..."
rm -rf "$OUTPUT_DIR"/*.md 2>/dev/null || true
log_step "重置记忆文件..."
The README presents the skill's functionality and usage instructions exclusively in Chinese, which can impose a language constraint on users without opt-in. Under the policy, forcing a specific language without offering a choice or documenting a justified locale limitation is a natural-language policy violation.
The skill repeatedly instructs the agent to read and write local files such as output/ and .learnings/, but it declares no explicit tool scope or permission boundary. That creates an authorization ambiguity: a host may grant broader file capabilities than users expect, enabling unintended workspace access or modification during ordinary writing requests.
The manifest text declares trigger words as "AI写小说、网文、小说生成" without narrowing context, exclusion conditions, or negative examples. Terms like "网文" and "小说生成" are generic enough to match many ordinary conversations about fiction writing, which can cause unintended invocation.
The English description says to use the skill when needed, but also states that the full description and trigger keywords are only in description_zh. This effectively makes core usage dependent on Chinese, without offering a language choice or documenting that the skill is intentionally region-specific.
The initialization workflow explicitly says it will clear old records in .learnings/ while preserving only template headers, yet there is no stated requirement for an explicit warning, preview, or confirmation. That creates a real risk of destructive data loss, especially in a skill centered on long-running writing projects where accumulated memory files are core user assets.
The manifest presents this skill as an AI novel-writing workflow that generates prompts, outlines, chapters, reviews, and Word-style outputs. However, the later sections shift into publishing revenue advice, platform payout estimates, and a direct WeChat contact for custom business services, which are not necessary capabilities or instructions for the stated purpose of creating novels.
This markdown file uses Chinese throughout for headings, instructions, and field labels, which can impose a fixed language on downstream skill usage. Under the policy, language-specific behavior should either be optional for the user or clearly justified as locale-specific.
The file title and instructions are entirely in Chinese and direct the system to auto-complete prompts in that language after the user provides a direction. There is no indication that the user can choose another language or that the Chinese-only constraint is required for a region-specific purpose, which fits the language/locale policy violation category.
The file title and instructions are entirely in Chinese and direct the reviewer to use this template for every chapter review, which implies a fixed language/locale for the skill's output. There is no indication that the user can choose another language or that Chinese is required for a justified region-specific purpose.
The trigger table states '每章写完' ('after every chapter is finished') as a trigger for running the full nine-dimension review, but it does not define what counts as 'finished' or any exclusion conditions. This ambiguity can cause the skill to activate during drafts, partial saves, or routine editing rather than only at an intended review point.
This markdown file consists entirely of Chinese instructions and examples, including the heading '示例集' and repeated Chinese-only templates. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue when no alternative or user choice is provided.
The --clean path irreversibly deletes prior output markdown files and overwrites multiple memory/state files without any confirmation, backup, or dry-run. In an agent-driven workflow, this can cause unintended data loss if the flag is passed automatically, misunderstood, or triggered by prompt/tool misuse.
The README advertises a memory system and failure logging but does not prominently disclose that story content, character data, plot details, and error information are persistently stored in .learnings/ files. This can expose user-provided content or sensitive brainstorming material to later sessions, other agents, or source-control commits if users are unaware of the persistence.
The README states that chapters are output as independent markdown files but does not clearly warn users that using the skill will create and persist local files. In an agent-skill context, undocumented writes can surprise users, leak sensitive prompts or story content into the workspace, and create unintended persistence that other tools may later read.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance exclusively in Chinese and does not indicate user opt-in, alternative language availability, or a justified region-specific constraint.
This markdown file contains user-facing instructional content exclusively in Chinese and does not mention any option to use another language. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy concern.
All user-facing help text, status messages, and usage instructions are presented only in Chinese. This imposes a fixed language/locale on users without opt-in or alternative language support, which matches the policy-violation category for language constraints.
No suspicious patterns detected.