ClawHub
Back to skill

Security audit

Novel Writer V3.2 - 小说写作引擎

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese novel-writing workflow skill with expected file-based draft and state handling, and no evidence of hidden code, credential access, network use, or unsafe persistence.

Install this if you want a Chinese-language, structured novel-writing workflow. Before using file-saving or continuation features, tell the agent which manuscript folder/files to use and ask it to confirm filenames before overwriting drafts or state files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is very broad and matches generic writing-related phrases such as '写小说', '写正文', '续写小说', and '检查质量', which can cause this skill to activate in many loosely related contexts. Over-broad activation increases the chance the agent applies this skill when the user did not intend full workflow enforcement, potentially causing inappropriate behavior, unexpected file/state handling, or instruction hijacking over more suitable skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scenario routing table uses ambiguous conditions like '继续写', '导入', '检查质量', and '查角色/查伏笔' without defining what corpus, project, or file set they apply to. In an agent setting, this ambiguity can misroute ordinary requests into stateful novel-management actions, leading to unintended access to prior context or unwanted workflow transitions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to '保存到文件' as part of the chapter-writing flow, but provides no user warning, consent gate, or path restrictions for local data modification. In a file-capable agent environment, this can lead to silent writes, overwriting existing content, or creation of persistent artifacts the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill content is presented as prescriptive writing guidance in Chinese, with no indication that the language is optional or limited to a China-specific use case. This can violate language/locale policy because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file presents all instructions and templates exclusively in Chinese, and there is no natural-language indication that users can select another language or that the skill is intended only for a Chinese-language context. The policy requires flagging forced language or locale choices when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.