Security audit
Security checks for vulnerabilities and agentic risk
This skill openly sets up a Chinese-language multi-agent workflow for novel writing, with persistent OpenClaw configuration changes that are disclosed and require user confirmation.
Before installing, review the generated openclaw.json changes, confirm you want these four agents allowed to message each other, and verify the Moonshot or Xiaomi model provider settings match APIs you trust. Expect the workflow and templates to default to Chinese web-novel conventions.
声明描述的是一个用于小说创作协作与多 agent 工作流初始化/编排的技能，核心能力应包括创建 agent、协调 writer/checker/planner/manager、推进写作流程等。而给出的代码仅实现了对章节 Markdown 文件的格式与内容约束检查，是一个离线校验脚本/CLI 工具。虽然“审稿/检查章节”与小说场景相关，但这里的实际行为仅限于 frontmatter 和字数等技术性验证，无法支撑声明中的主要用途，因此属于明显的描述与行为不匹配。
声明描述的是一个面向长篇网络小说协作生产的多代理工作流技能，核心能力应包括创建多个 agent、协调写作/审稿/规划流程、推进任务阶段等。而实际代码只是一个独立的命令行字数统计工具：接收文件路径、读取文件、统计非空白字符数并输出结果。其主要用途、能力范围、交互方式和资源访问模式都与声明严重不符，因此应判定为明显不匹配。
Without declared permissions the skill's intent is opaque and cannot be validated.
The file’s natural-language description, trigger phrases, workflow steps, and usage examples are entirely specified in Chinese, indicating the skill is intended to operate in a fixed language. The policy requires flagging language or locale constraints when the skill does not explicitly offer a user choice or opt-in, and no such choice is documented here.
The file instructs the agent in Chinese ('你是小说审稿人...'), establishing a Chinese-language operating mode with no indication that users may choose another language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly justified.
The file presents the agent persona and all operating instructions exclusively in Chinese, which implies a fixed language/locale for interaction. There is no indication that the user can opt into another language or that the Chinese-only constraint is required for a region-specific purpose.
Line L003 states the agent role entirely in Chinese, effectively setting the skill's operating language without offering the user a language choice or explaining a region-specific requirement. This is a natural-language locale policy issue because the file imposes a specific language by default rather than making it optional.
The file presents all operational instructions in Chinese and does not indicate that the user can choose another language. This can violate a language/locale policy when users have not explicitly opted into Chinese or when the skill is expected to be language-neutral.
The file uses Chinese-only user labeling and specifies a fixed form of address ('大哥') without indicating that the user can choose their preferred language or salutation. This creates a natural-language policy issue because it imposes a locale and style assumption on all users.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"providers": {
"moonshot": {
"baseUrl": "https://api.moonshot.cn/v1",
"api": "openai-completions",
"models": [
{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"apiKey": "MOONSHOT_API_KEY"
},
"xiaomi": {
"baseUrl": "https://api.xiaomimimo.com/anthropic",
"api": "anthropic-messages",
"models": [
{
The file defines the agent entirely in Chinese ('你是小说规划师') and provides no option for the user to choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The intervention triggers are broad and ambiguous, such as activating on vague requests like organizing ideas, multi-chapter production, or major revisions. In an orchestrated agent environment, this can cause the planner to activate outside its intended scope, leading to unintended routing, overreach into user tasks, or interference with other agents' responsibilities.
This markdown file presents all operational instructions and role guidance in Chinese, but does not indicate that the user can choose another language or that Chinese is required for a documented reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The tool descriptions are written entirely in Chinese, with no indication that language choice is optional or that the skill is specifically intended for a Chinese-only context. This creates a natural-language locale policy concern because the file implicitly constrains interaction language without user opt-in.
The file specifies user-facing content entirely in Chinese and sets a fixed form of address and style preference without indicating any user choice or opt-in. This can violate language/locale policy when a skill assumes a language preference rather than offering or documenting it as configurable.
Line L003 states in Chinese that the agent is a web-novel writer responsible for producing and revising content, implicitly setting the skill's operating language and style to Chinese. The file does not provide any user opt-in, alternative language option, or justification that this is a region-specific skill, which creates a natural-language locale policy concern.
This markdown file contains all operational instructions in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy for natural-language constraints, forcing a specific language without opt-in is a reportable issue.
The file's user profile section is written entirely in Chinese and specifies persona/style preferences without indicating that language choice is optional or user-selected. This creates a natural-language locale policy concern because it implicitly constrains interaction to a specific language without documented opt-in or justification.
The skill modifies openclaw.json to enable agentToAgent communication for multiple agents, which expands the trust boundary beyond merely creating a local novel-writing workflow. Even if intended for orchestration, enabling cross-agent messaging can permit unintended task delegation, prompt/data propagation, or abuse by a compromised or misconfigured agent.
The manifest frames the skill as a novel collaboration/orchestration helper that creates four agents and sets up a writing workflow. Directing the user to stop and start the gateway introduces operational control over the hosting platform, which is a broader administrative capability not inherent to novel writing orchestration itself.
The entire guidance document is written only in Chinese and instructs agents to merge this content when the user selects the platform style, but it provides no language-choice mechanism or notice that output should remain in Chinese. This can create a locale-policy issue if the skill is applied for users who have not opted into Chinese-language behavior.
The file is entirely written in Chinese and presents the quality standard as a universal requirement, but it does not indicate that the language choice is optional or limited to a China-specific workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown template is entirely written in Chinese and prescribes Chinese output formats such as 第XXX章_审查报告.md and 第XXX章审查报告, which imposes a specific language/locale on users. The file does not offer an opt-in choice or explain a region-specific need for this constraint, so it violates the language/locale policy criteria.
The boundary between planner, checker, and manager activation is not sharply defined, and several prompts about 'what to do next', 'whether it passes', or 'how to proceed' can plausibly fit more than one role. This ambiguity can cause inconsistent routing decisions, leading to the wrong agent receiving sensitive context or producing authoritative-seeming review decisions without the intended review flow.
No suspicious patterns detected.