Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese novel-writing workflow that creates and updates local story project files, with no evidence of credential theft, network exfiltration, destructive behavior, or hidden persistence.
Install only if you want a Chinese-language novel-writing assistant that will create and maintain files in your project workspace. Use explicit /novel commands for file-writing steps, review generated memory/tracking files before relying on them, and note that the package should have its unresolved version conflict markers fixed.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
继承了其七步方法论和写作知识库。
---
# Novel Write Skill - OpenClaw 小说创作系统
## 概述
The file reproduces Ronald Knox's historically discriminatory rule stating that 'Chinese people' should not appear in the story, even though it is labeled as an 'original version.' Including exclusionary language in a reusable skill/knowledge base can normalize biased guidance, confuse downstream users or agents, and lead to discriminatory outputs if the surrounding clarification is missed or removed.
The trigger examples include broad natural-language phrases that can match ordinary conversation, increasing the chance the skill activates unintentionally. Because this skill performs multi-step project actions and file creation, accidental activation can lead to unwanted writes, state changes, or workflow execution without sufficiently explicit user intent.
The README states that the skill will automatically create project directories and persist multiple files, but it does not clearly warn users before local filesystem writes occur. Lack of transparent disclosure and consent around writes can cause unexpected data creation, overwrites, or workspace pollution, especially when combined with broad natural-language triggers.
Several step examples use vague prompts like proceeding to the next step, which blurs the boundary between casual dialogue and command execution. In a skill that chains file generation, tracking updates, and blocking checks, ambiguous activation raises the risk of unintended operations and makes prompt-injection or conversational confusion easier to weaponize.
Several trigger phrases such as '继续写', '开始第一章', and '生成关系图' are generic enough to overlap with normal conversation. This raises the risk of accidental command dispatch, unintended workflow progression, and downstream side effects like writing files or altering project state.
The trigger rule allows activation from broad Chinese natural-language intent instead of requiring an explicit command. In an agent environment, this can cause the skill to engage on ordinary conversation and begin planning actions or file operations the user did not clearly authorize.
The skill documents automatic creation of directories, JSON trackers, and copied knowledge-base content without a clear warning or consent boundary. In agentic systems, silent filesystem writes are dangerous because a casual request can unexpectedly create or modify persistent local state.
The conversational triggers are broad enough to match ordinary discussion like '分析写作质量' or '质量检查', which can cause the skill to activate unintentionally during normal conversation. This creates prompt-routing ambiguity and may invoke analysis behavior when the user did not explicitly intend to run the command, increasing the risk of misexecution or context leakage into the skill workflow.
The conversational trigger phrases are broad enough that ordinary user messages like '回答关于故事的问题' could unintentionally invoke this skill. That can cause the agent to switch into file-oriented planning behavior unexpectedly, including reading project files and preparing updates, which is a real prompt-routing and unintended-action risk even if the skill is not overtly malicious.
The skill explicitly instructs the agent to create or update files under memory/ (memory/constitution.md and optionally memory/style-reference.md) without any user-facing warning, confirmation gate, or indication that local project data will be modified. Even though the files appear intended for workflow state, silent writes can overwrite prior content, persist untrusted instructions for later steps, and surprise users by mutating the workspace.
The conversational triggers like “生成关系图 / 生成战斗图 / 生成势力图” are broad natural-language phrases that could be matched during ordinary discussion, causing the skill to activate unexpectedly. In a file-writing skill, unintended activation can lead to unauthorized reads of tracking data and writes into the story workspace, especially if the agent auto-executes commands based on loose phrase matching.
The automatic trigger condition (“every 5 chapters or at key plot moments”) is vague and not bounded by explicit user authorization, making background activation likely. Because this skill reads project tracking files and appends to output files, ambiguous auto-triggering can cause unintended data processing, noisy file growth, and actions that the user did not explicitly request.
The conversational triggers "记录这次问题" and "查看失败记录" are broad, natural-language phrases likely to appear in ordinary writing-assistance dialogue. This can cause accidental invocation of the skill, leading to unintended reads or writes of project state such as failure logs and review output without explicit user intent.
The conversational triggers include very generic phrases such as '初始化新小说项目', '创建新项目', which can easily match ordinary user conversation rather than an explicit command invocation. In an agent skill that performs filesystem writes and directory creation, this increases the chance of unintended execution and unauthorized workspace changes from ambiguous natural-language input.
The conversational triggers are broad enough that ordinary chat phrases like '把这段设定记下来' or '更新记忆' could activate the skill without an explicit command, causing unintended state changes. In this skill’s context, that means user text may be persisted into project memory files automatically, increasing the risk of accidental writes, prompt-injection persistence, and contamination of future writing context.
The skill explicitly instructs the agent to automatically append user-provided content into .learnings/ files, but does not require notice, confirmation, validation, or review before modifying project files. This is dangerous because untrusted conversational input can be persisted as durable project state, including malicious instructions, incorrect facts, or sensitive content that will later be re-read and influence subsequent actions.
The conversational trigger phrases are broad, generic requests that can easily overlap with ordinary user conversation, causing the skill to activate when the user did not explicitly intend to invoke it. In an agent environment, this can lead to unintended file reads/writes and workflow execution, especially because the skill performs multi-step planning actions and writes output to a project path.
The conversational triggers are generic natural-language phrases like '定义故事规格' and '创建故事规格文档', which can easily appear in ordinary discussion and accidentally invoke the skill. Because the skill later writes a file and performs automatic knowledge-base loading, unintended activation can cause workspace modifications or context shifts without clear user intent.
The conversational triggers '分解任务清单' and '生成写作任务' are generic natural-language phrases that can easily appear in ordinary user requests unrelated to invoking this specific skill. In an agent environment that routes by trigger matching, this can cause unintended activation, leading the agent to read and write project files or advance workflow state when the user only meant to discuss task planning at a high level.
The conversational triggers '生成时间线', '创建时间线文档' are broad natural-language phrases that can plausibly appear in ordinary discussion, making accidental invocation more likely. In a skill system that maps free-form user text to privileged file-reading/writing actions, this can cause unintended execution and modification of story artifacts even without explicit slash-command use.
The skill defines very broad conversational triggers such as '更新进度追踪' and '检查写作状态' that can plausibly occur in ordinary user conversation. This can cause the command to activate unintentionally, leading to unexpected file reads, validation/blocking behavior, or workflow interruption without explicit user intent.
The title and all operational instructions are written as a Chinese-only command experience, and the trigger examples at L11-L12 assume Chinese-language use. There is no indication that users may choose another language or that the locale restriction is optional or justified as region-specific, which creates a natural-language policy concern.
This markdown file contains natural-language guidance exclusively in Chinese, including the title, instructions, and examples, but does not indicate that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.
This markdown file contains natural-language guidance that effectively assumes Chinese as the operating language for the skill knowledge base, beginning with a Chinese title and continuing throughout the document. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy issue unless the constraint is clearly justified or users are offered a choice.
No suspicious patterns detected.