T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
zh-novel-writer - 批量生成引擎
Security checks for vulnerabilities and agentic risk
Overview
This Chinese novel-writing skill is coherent, but it should be reviewed because it can send manuscript text to third-party LLMs and may keep making paid API calls without a clear per-chapter limit.
Install only if you are comfortable sending outlines and generated text to the listed LLM providers. Use a dedicated API key with spending limits, run it in a contained environment, and avoid very broad chapter ranges until the script has request and progress limits.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/batch_generate.py:165- Finding
Unbounded Chapter Generation Loop Can Exhaust API Quotas and Local Resources
- Content
View full analysis
= TARGET_WORDS: print(f" 完成: {current_len}字") break needed = TARGET_WORDS - current_len + 500 print(f" 第{segment}段: 当前{current_len}字, 需加~{needed}字... ", end="", flush=True) prompt = make_prompt(chapter_num, chapter_title, plot, prev_ending=ending_snippet, segment=segment, target=needed) text, api_used = api_call_with_fallback(prompt) if not text: print(f"\n 所有API都失败了, 跳过本章") return False add_cn = count_chinese(text) all_text += ("\n\n" if all_text else "") + text total = count_chinese(all_text) print(f"{api_used}: +{add_cn}字 = {total}字") segment += 1 time.sleep(MIN_API_DELAY) ``` ### Technical Analysis The loop terminates only when `count_chinese(all_text)` reaches `TARGET_WORDS`. It has no maximum segment count, API-request budget, elapsed-time deadline, accumulated-response size limit, or minimum-progress requirement. A successful API response is accepted whenever `text` is nonempty. If a provider repeatedly returns nonempty content containing few or no characters counted by `count_chinese`, `current_len` may remain unchanged or increase too slowly. The script then continues making API requests indefinitely. The fifteen-second delay reduces request frequency but does not impose a finite bound. Each accepted response is appended to `all_text`, so responses that do not contribute to the completion metric can also cause continuous memory growth. The accumulated text is not written until the target is reached, increasing the likelihood ...[truncated 1320 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file states these constraints are '注入所有 prompt', making the Chinese-only restriction a global policy applied to all generated prompts. A universal forced locale is a stronger policy concern because it removes any opportunity for user language preference.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill explicitly reads API keys from environment variables, reads local files, writes generated chapter files, and sends user-provided text to external network endpoints, but it does not declare any tool scope or permission boundaries. This creates an authorization and transparency gap: an agent or reviewer cannot easily constrain or audit the skill’s access to secrets, filesystem contents, or outbound data flows, increasing the risk of unintended secret exposure or excessive data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt explicitly requires '纯中文' and forbids any English or Arabic numerals, which imposes a fixed language/locale constraint. The file does not offer user opt-in or explain a justified region-specific need, so this is a natural-language policy violation under the language-choice rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This line again forces output to be entirely in Chinese and prohibits English and Arabic numerals. Repeating the constraint in another template section reinforces a hardcoded locale policy without user choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language constraint explicitly requires exclusively Chinese output and forbids English or Arabic numerals. This imposes a fixed language policy in the skill behavior without user opt-in or an explained region-specific justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script transmits user-provided outline, plot details, and prior chapter text to third-party LLM endpoints, but it does not provide an explicit runtime warning, consent step, or data-handling notice before doing so. This creates a real privacy and data-governance risk because users may unintentionally send proprietary, confidential, or sensitive manuscript content to external services with different retention and logging policies.
- Content