story writer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.0

Overview

This is a local story-writing skill that saves and exports project files, with no hidden network, credential, or background behavior found.

Install only if you are comfortable with a local writing tool creating and overwriting project files. Keep backups before running drafting commands, especially --all. Do not open or share exported HTML made from untrusted chapters or discovery data unless the content is sanitized or the exporter is fixed to escape HTML.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export-html.py:48

Finding

Stored HTML and JavaScript Injection in Exported Books

Content

View full analysis

{line[3:]}') elif line.startswith('### '): html_lines.append(f'

{line[4:]}

') elif line.startswith('#### '): html_lines.append(f'

{line[5:]}

') # Convert emphasis elif '**' in line or '__' in line: # Simple bold conversion line = line.replace('**', '').replace('__', '') # Need to close tags properly in real implementation html_lines.append(f'

{line}

') # Convert italics elif '*' in line or '_' in line: line = line.replace('*', '').replace('_', '') html_lines.append(f'

{line}

') # Empty line elif line.strip() == '': html_lines.append('

 

') # Regular paragraph else: html_lines.append(f'

{line}

') return '\n'.join(html_lines) ``` Additional unescaped interpolation occurs when chapter metadata and discovery values are added to the final document: ```python # Generate table of contents toc_items = [] for chapter in chapters: toc_items.append(f'

{chapter["title"]}

') toc_html = '\n'.join(toc_items) # Generate chapter HTML chapter_html = ...[truncated 2888 chars]

Remediation

View remediation

``` 7. Add automated tests using hostile values in chapter text, headings, title, genre, and author fields. Test payloads should include `

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents a --fix mode for review-book.py that can automatically modify chapter files, but it does not warn the user that content may be changed or advise backup/confirmation before use. In a writing workflow, silent or poorly disclosed auto-modification can cause unintended edits, data loss, or corruption of creative work, especially if users assume the command is read-only review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/discovery.py (reported line 303)May include surrounding context.

python

def main():
    parser = argparse.ArgumentParser(description="Story Discovery Questionnaire")
    parser.add_argument("--output", "-o", help="Output file path", default=None)
    parser.add_argument("--load", "-l", help="Load previous session", default=None)
    args = parser.parse_args()
    
    # Load previous session if specified

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/discovery.py (reported line 306)May include surrounding context.

python

def main():
    parser = argparse.ArgumentParser(description="Story Discovery Questionnaire")
    parser.add_argument("--output", "-o", help="Output file path", default=None)
    parser.add_argument("--load", "-l", help="Load previous session", default=None)
    args = parser.parse_args()
    
    # Load previous session if specified

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring states that reviews cover 'adherence to story bible'. However, although the book bible is loaded at L042-L045 and passed into calculate_category_scores at L068 and L702, the parameter is never referenced inside the function body, so no actual comparison against the story bible occurs. This is an active contradiction between documented intent and implemented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring says the script reviews chapters for 'plot adherence', which implies comparing chapters against the book bible or other plot reference material. In practice, the loaded book_bible_content is only passed through to report-generation functions and not substantively used for validation; the implemented checks are mostly heuristics like word count, adverbs, passive voice, and chapter-ending hooks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example HTML output sets lang="en", which imposes a specific language/locale in the exported artifact. Because the skill otherwise presents itself as a general story-writing system and does not mention language selection or justification for English-only output, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The entries "Chick Lit," "Lad Lit," and "Fratire" are described in explicitly gendered terms such as "Women's popular fiction" and "For young men," which can reinforce a fixed gender framing in the skill's natural-language guidance. While this is a reference document, the language is presented as authoritative classification without any note that such labels may be dated, contested, or optional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code saves all questionnaire responses to a JSON file, including custom free-text answers the user may enter. Although writing output is part of the tool's purpose, there is no confirmation prompt or explicit user-facing disclosure in this file at the point of save that their responses will be persisted locally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The command-line help text advertises '--fix' as 'Attempt to auto-fix minor issues', suggesting the flag triggers corrective changes. However, when used, the script only prints 'Auto-fix not yet implemented' and performs no fixes at all.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.