Novel Character Graph

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:41 AM UTC
• Version: 1.0.2

Overview

The skill is mostly purpose-aligned, but it explicitly allows dependency installation without user approval and includes report-generation risks that warrant review before installation.

Install only if you are comfortable reviewing commands before they run. Do not allow automatic package installation; require explicit approval for any apt, sudo, pip, or media conversion command. Keep source novels backed up, write outputs to a separate directory, and avoid opening generated HTML reports from untrusted novel data unless the template is fixed to escape content and avoid remote scripts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:295

Finding

Dependency Installation Is Authorized Without User Consent

Content

View full analysis

Installation dependency: `sudo apt install calibre-bin poppler-utils pandoc` ``` ```markdown ## Step 8: Advanced Scripts (Optional) > The following scripts are located in the `scripts/` directory. Verify the environment before execution; dependencies may be installed without user approval. ``` The original instruction at line 295 explicitly states that dependencies may be installed without user approval. Elsewhere, line 65 supplies a `sudo apt install` command as the dependency-installation procedure. ### Technical Analysis The Skill instructs the agent to bypass user consent when installing dependencies. Because the documented installation command uses `sudo`, following these combined instructions can cause privileged, system-wide package installation. Dependency installation is not inherently malicious, but suppressing approval for a privileged operation violates least-privilege and informed-consent boundaries. Package installation can modify system directories, package databases, executables, shared libraries, service definitions, and configuration files. The action also expands the trusted computing base by retrieving and installing components from configured package repositories. This is primarily an instruction-hijacking issue because the Skill changes how the agent should handle approval. It also presents a privilege-escalation risk when the agent has access to unattended or cached `sudo` privileges. ### Attack Path 1. A user invokes the Skill to process a supported novel format. 2. The agent checks for commands such as `ebook-convert`, `pdftotext`, or `pandoc`. 3. One or more commands are unavailable. 4. The instruction at `SKILL.md:295` tells the agent that dependencies may be installed without user approval. 5. The agent ru ...[truncated 915 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_html.py:24

Finding

Unescaped Novel Data Enables Stored HTML and SVG Injection

Content

View full analysis

{char['name']}

{char.get('identity', '')}

修为：{char.get('realm', '未知')}

''' # Generate relationship graph SVG graph_svg = generate_svg_graph(characters, relationships) # Replace placeholders template = template.replace('', cards_html) template = template.replace('', graph_svg) ``` The SVG node label is also generated without escaping: ```python svg_parts.append( f'' f'' f'{char["name"][:4]}' ) ``` ### Technical Analysis The generator inserts `title`, `subtitle`, character names, identities, and realms directly into HTML or SVG markup. No HTML escaping, SVG text escaping, sanitization, or restrictive content policy is applied. These values may originate from untrusted novels or caller-supplied analysis results. An attacker can supply text containing markup delimiters that terminate the intended text element and introduce new HTML or SVG elements. Because the result is persisted to `index.html`, this is a stored injection vulnerability. The four-character truncation applied to SVG labels does not constitute sanitization. More importantly, full character names and o ...[truncated 1555 chars]

Remediation

View remediation

`, `&`, `"`, and `'`, as well as attempted HTML/SVG event-handler payloads. A minimal text-escaping helper could be introduced as follows: ```python from html import escape def safe_text(value): return escape(str(value), quote=True) safe_title = safe_text(title) safe_subtitle = safe_text(subtitle) safe_name = safe_text(char.get("name", "")) safe_identity = safe_text(char.get("identity", "")) safe_realm = safe_text(char.get("realm", "Unknown")) ``` Only escaped values should be interpolated into the HTML and SVG templates. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: assets/graph_template.html:7

Finding

Generated Reports Execute an Unpinned Remote JavaScript Dependency

Content

View full analysis

``` The template also loads a remote stylesheet at line 9: ```css @import url('https://fonts.googleapis.com/css2?family=Ma+Shan+Zheng&family=Noto+Sans+SC:wght@400;500;700&display=swap'); ``` The JavaScript dependency at line 7 is the security-relevant executable resource. ### Technical Analysis Every report generated from this template loads and executes JavaScript from `cdn.tailwindcss.com` when opened with network access. The URL does not identify an immutable, reviewed artifact, and no Subresource Integrity hash is supplied. Consequently, the effective JavaScript executed by a report can change after the Skill package has been audited. The trust boundary therefore extends to the CDN, its delivery infrastructure, DNS and TLS ecosystem, and the upstream resource. The external request also discloses ordinary connection metadata, such as the viewer's IP address and user-agent information, to the remote provider. This behavior fits remote payload retrieval and execution because executable code is fetched at report-view time. It also represents an insecure dependency-management practice because the executable frontend dependency is neither locally bundled nor integrity-pinned. ### Attack Path 1. The Skill creates an `index.html` report from `graph_template.html`. 2. A user opens the generated report while connected to the network. 3. The browser requests `https://cdn.tailwindcss.com`. 4. The CDN returns the current JavaScript associated with that mutable endpoint. 5. The browser executes the returned code in the report's page context. 6. If the CDN account, upstream resource, or delivery path is compromised, a modified response can execute attacker-controlled browser code without any change to the audited pr ...[truncated 583 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full-featured novel analysis and media-generation skill. The supplied code chunk only implements chapter splitting for a UTF-8 text file using regular expressions and writes each detected chapter to separate TXT files. While chapter-by-chapter splitting could be a supporting preprocessing detail for a larger novel-analysis system, this code alone does not perform the core declared functions and lacks most of the claimed capabilities, format support, encoding handling, and output types. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a comprehensive novel-analysis and media-generation skill, but the supplied code only implements a narrow helper utility for extracting likely Chinese personal names from a UTF-8 text file. It does not analyze novels broadly, map relationships, process EPUB/PDF/DOCX, handle multiple encodings, generate visualizations, or create songs. The code’s actual purpose is materially narrower and different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: novel-character-graph
description: "Professional long-form novel analysis and character relationship mapping + theme song generation. Automatically handles GBK/UTF-8 encoding, multi-GB file chunking, chapter-by-chapter incremental parsing, supports TXT/EPUB/PDF/DOCX novel formats. Outputs complete character system, relationship maps, worldviews, weapon/item systems, interactive visualization HTML, and AI-generated theme songs (Suno). Use when users ask for: novel analysis, character mapping, relationship graphs, worldview architecture, story timeline organization, manga/comic adaptation settings, novel theme song,

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Instructing the agent to install dependencies without approval bypasses a critical trust boundary. This is dangerous because installation changes the execution environment, may pull code from external repositories, and can enable further file access or command execution beyond the user's expectation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill performs file reads and writes, invokes shell commands, and generates output files, yet it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope constraints can allow the skill to access or modify files more broadly than intended, increasing the blast radius of mistakes or prompt-induced misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation triggers and usage hint are entirely in Chinese and define invocation based on Chinese phrases only. This imposes a language constraint without any opt-in, alternative language triggers, or documentation that the skill is intentionally limited to Chinese-language usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The preprocessing command writes a derived file via a temporary file and then moves it into place without warning, which can overwrite prior outputs or clobber files if paths are reused carelessly. In a workflow handling user-supplied filenames, silent overwrites can cause data loss and make recovery difficult.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The documentation recommends using sudo apt install, which normalizes privileged execution for routine skill setup. Encouraging root-level package installation in an agent workflow is dangerous because it can permanently modify the host system and magnify the impact of package compromise or operator error.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

| ✅ `.docx` | `pandoc -s file.docx -o output.txt` | `pandoc` |
| ✅ `.mobi` | `ebook-convert file.mobi file.txt` | `calibre-bin` |

> 安装依赖：`sudo apt install calibre-bin poppler-utils pandoc`

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The ffmpeg examples create output files directly with overwrite behavior (-y) and no confirmation, which can silently replace existing media files. This is not remote code execution, but it is still a meaningful safety issue because the skill handles user content and may destroy or alter outputs without consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly states that dependencies may be installed without user approval, which is unsafe because package installation executes privileged system changes and may introduce unreviewed software into the environment. In an agent setting, this can be abused to expand capabilities, alter the host, or process sensitive user files with tools the user did not authorize.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Permitting unapproved dependency installation is especially risky in a skill that processes user-provided documents, because new tools can ingest, transform, or export those files in unreviewed ways. The context increases danger: the skill encourages bulk processing of large local files, so unvetted tooling broadens opportunities for privacy loss or unintended data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The HTML declares lang="zh-CN" and all visible UI labels and headings are written in Chinese, which imposes a specific language/locale on users. The file does not indicate that this is optional, configurable, or limited to a region-specific use case, so it appears to violate the language-choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch conversion loop rewrites each original .txt file in place after a successful iconv conversion, which can permanently destroy the source copy if the conversion is lossy, misdetected, or partially wrong. In a skill designed to process novels in many encodings, this is more dangerous because users are specifically likely to run it on valuable source manuscripts or hard-to-replace text archives at scale.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/format_handbook.md (reported line 29)May include surrounding context.

bash

# Debian/Ubuntu
sudo apt install calibre-bin poppler-utils pandoc

# 转换命令
ebook-convert novel.epub novel.txt

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a full novel-analysis skill with GBK/UTF-8 handling, multi-format support (TXT/EPUB/PDF/DOCX), incremental parsing, relationship mapping, visualization, and theme-song generation. This file only opens a UTF-8 text file, extracts candidate Chinese names with a regex, and prints frequencies, so the actual behavior here does not match the broader capability claims for the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.