ClawHub
Back to skill

Security audit

zh-novel-writer - 批量生成引擎

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed batch novel-writing helper that sends user-provided outline and chapter context to named LLM APIs and saves generated chapters locally.

Install only if you are comfortable sending your outline, plot notes, prompts, and chapter excerpts to the configured LLM provider. Use limited or disposable API keys where possible, avoid confidential manuscripts or personal data, and choose an output directory where generated markdown files can safely be written.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends user-provided outline content and prior chapter text to third-party LLM APIs without an explicit disclosure or confirmation step. If users include unpublished manuscripts, sensitive notes, or proprietary story material, that data is exposed to external providers and may be retained or processed under their policies.

Static analysis

No suspicious patterns detected.