Story Causal Engine

• Outcome: Pass
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.1.0

Overview

The skill is a local story-analysis and generation helper, with some under-disclosed optional LLM and report-writing behavior users should understand.

Install only if you are comfortable using it on story drafts in the current workspace. Do not attach a cloud LLM provider for private manuscripts unless you accept sending plot and character context to that provider, and be aware that generating a novel writes audit_report.html in the working directory and may overwrite an existing file with that name.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises local processing and includes usage that loads user-provided files and can write outputs, but it does not declare any permissions for file access. Undeclared read/write capability weakens user consent and platform enforcement, and could allow broader filesystem interaction than users expect from a story-auditing skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose frames the skill as a deterministic auditing tool, but the detected behavior includes content generation, rewriting, state mutation, character auto-registration, and report file creation. This mismatch is dangerous because users and policy systems may grant trust appropriate for a passive analyzer while the skill actually performs broader, stateful, and persistent actions that can alter content and write artifacts to disk.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill's declared role is story auditing, but this code also rewrites user content through an LLM and later produces persisted output artifacts. That scope expansion matters because users may supply sensitive drafts expecting local analysis, while the implementation can transform and externalize narrative data beyond the advertised auditing function.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: These functions generate node text and bridging passages by sending story context, character state, and emotional data to an LLM provider, which materially exceeds a passive audit role. In a security context, this is dangerous because it creates an undeclared outbound data channel and can expose proprietary or sensitive manuscript content to external services.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The engine assembles a full novel and writes an HTML report to a fixed local file, which is beyond the stated audit-only behavior. Silent file creation can leak sensitive content into the runtime filesystem, surprise host applications, or overwrite expected artifacts in shared working directories.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The prompt construction includes self.global_state.characters and related emotional context, which may contain user-authored or sensitive data, and sends it to an arbitrary LLM provider without any visible disclosure or consent mechanism. This is a real privacy and data-governance issue, especially because the skill is presented as an auditing tool rather than a remote content-processing pipeline.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The bridge-generation path sends previous and next plot context plus emotional state hints to the LLM provider, again without visible notice or user approval. In the context of creative writing, that can expose unpublished plot material, character arcs, or other proprietary content to third-party services.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.