T01 · Skill Instruction Hijacking
Warning
- Location
scripts/chapter_pipeline.py:764- Finding
Undisclosed External MCP Tool Invocation Embedded in Generated Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Junli Ai Novel
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly fits its Chinese web-novel workflow, but it generates an under-disclosed external MCP lookup that could send unpublished plot details to an unspecified tool.
Review before installing. The local project-file workflow is expected, but do not allow the generated coze-mcp-* lookup to run unless you know which MCP tool will be called, what plot or manuscript details will be sent, and that you want external research for that chapter. Treat any external results as untrusted reference material.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个覆盖长篇网文创作全流程的综合写作助手，包含内容生成、项目管理、记忆维护和质量检查等多项能力。但提供的代码只实现了章节文件字数统计与达标检查，属于“章节质检”中的一个很小子功能。虽然这与声明中的“章节质检”存在部分关联，但代码的主要目的与声明的整体定位差距很大，且未体现任何续写、返修、项目记忆、分卷治理等核心能力。因此应判定为描述与实际行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个功能范围很广的长篇网文写作助手，核心应包括生成、续写、记忆管理、结构治理与质检等完整创作流程能力。代码却只实现了对已有章节文本的关键词匹配分析，检测“爽点”和“毒点”，并给出分数、密度和简单建议。这属于章节质检中的一个狭窄子模块，而非综合写作助手。虽然“章节质检”与代码存在部分重合，但整体主用途明显不一致，且声明中的多数关键能力在代码中完全没有体现，因此应判定为描述与实际行为不匹配。
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python continue data["path"] = str(path) rules.append(data) return rules def lint_chapter_text(text: str, rules: list[dict[str, Any]]) -> list[dict[str, Any]]:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python finish_parser.add_argument("chapter_path", help="章节文件路径") finish_parser.add_argument("--summary", help="本章摘要") finish_parser.add_argument("--word-count", type=int, help="手动指定章节字数") finish_parser.add_argument("--skip-checks", action="store_true", help="跳过写后检查") finish_parser.set_defaults(handler=handle_finish) audit_parser = subparsers.add_parser("audit", help="阶段/卷审计")
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python finish_parser.add_argument("chapter_path", help="章节文件路径") finish_parser.add_argument("--summary", help="本章摘要") finish_parser.add_argument("--word-count", type=int, help="手动指定章节字数") finish_parser.add_argument("--skip-checks", action="store_true", help="跳过写后检查") finish_parser.set_defaults(handler=handle_finish) audit_parser = subparsers.add_parser("audit", help="阶段/卷审计")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The title and the entire document are written as Chinese-only operating instructions, which effectively imposes a specific language/locale on users. The file does not indicate that Chinese is optional, configurable, or limited to a justified region-specific use case.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to read and update many project files and to run local scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authority gap where a host agent may grant broader file access than users expect, increasing the risk of unintended reads or writes across the workspace.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and title present the skill entirely in Chinese and position it as a default writing assistant for a Chinese web-novel platform context, with no indication that other languages are supported or that the user can opt into a preferred language. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document title and the entire skill guidance are written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language or region-specific context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template is entirely written as a prescriptive chapter format in Chinese and states default requirements for chapter files, implying the skill should produce content in Chinese by default. This is a language policy concern because it enforces a specific language/locale without offering user choice or documenting an opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow is entirely written and operationalized in Chinese, with no indication that the user may choose another language or that outputs should follow the user's language preference. In an agent setting, this can cause unwanted language switching, reduce user comprehension, and increase the risk of misunderstood instructions or inaccessible outputs, though it is not a classic security exploit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file presents all skill content exclusively in Chinese starting from the title, with no indication that language choice is optional or that the document is intended only for a Chinese-language audience. The policy for this audit flags language/locale constraints when a skill forces a specific language without user opt-in or clear region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file is entirely written as mandatory instructions in Chinese, beginning with a Chinese-only title and guidance, with no indication that another language may be used or that the locale restriction is optional. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill file is written in Chinese and presents its guidance exclusively in that language, with no indication that the user may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate a language/locale policy when a skill constrains interaction language without explicit opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill guidance is written as Chinese-only instructional content and does not mention any option for users to choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file is entirely written in Chinese and does not provide any indication that the user can choose another language or that the locale restriction is intentional for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all instructions in Chinese and does not indicate that the user can choose another language or that the skill is intended only for a Chinese-language or region-specific context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill is written as Chinese-only guidance and does not indicate that users may choose another language or locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill document is written in Chinese and presents its guidance exclusively in that language, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown template is entirely written in Chinese and presents the skill content as a fixed-language format, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is entirely written as a Chinese-language checklist and directly instructs the user to use it before delivery, without indicating that other languages are supported or that Chinese is optional. Under the policy rule, a skill that effectively mandates a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
整个文档以中文撰写，且未见任何说明允许根据用户偏好切换语言或由用户选择输出语言。按规则，若技能在自然语言层面默认强制单一语言且没有 opt-in/choice，属于语言或 locale 政策风险。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions include broad, everyday user complaints like '钩子弱' or '留存低', which can overlap with normal writing feedback and cause the skill or this reference to activate outside its intended suspense-design scope. In an agent setting, over-broad activation can route benign requests into specialized behavior unexpectedly, reducing predictability and potentially causing inappropriate instruction application.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire document is written as a mandatory Chinese-language workflow artifact and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.