Security audit

short-fiction-manuscript-formatting

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed short-story manuscript formatter that reads a user-provided Markdown file and writes a DOCX output, with personal contact details used for the expected submission cover block.

Install only if you want an agent to format short-story manuscripts into DOCX files. Use a deliberate output path because the script can overwrite that file, and remember that the generated manuscript may contain your legal name, address, phone, and email if you provide them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is directionally related but materially incomplete. The code is not just a simple formatter that sets one short story in Courier New; it is a full manuscript-to-DOCX converter implementing a specific Shunn modern short-fiction submission format. It parses input files with YAML-like front matter, computes running headers and rounded word counts, transforms punctuation and inline markup, rejects certain manuscript types and content, writes a DOCX package, verifies the produced document, and supports CLI/self-test/reporting behavior. Those are substantial undeclared capabilities beyond the narrow stated description and no permissions are declared despite file read/write behavior. Therefore this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill appears to require file read/write behavior but does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause overbroad or ambiguous file access, making it easier for the skill to read or write unintended files if invoked with crafted paths or in a misconfigured runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs collection of legal name, postal address, phone number, and email, which are sensitive personal identifiers, but provides no privacy notice, minimization guidance, retention limits, or warning before handling them. In an agent ecosystem, this increases the risk of unnecessary PII exposure in prompts, logs, generated files, or downstream tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code ingests fields such as legal name, address, phone, and email and includes them in the output manuscript. Although this is functionally part of formatting, there is no user-facing disclosure in the CLI help or code comments near execution warning that personal contact information will be embedded into the generated .docx file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a safety-relevant file write by creating parent directories and writing a .docx archive to the destination path. While the CLI requires an output path, there is no confirmation prompt, visible warning, or nearby comment/docstring disclosing that the command will create or replace the specified file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.