Security audit

epic-novel-writer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent novel-writing workflow skill that mainly creates and archives project files, with disclosed safeguards for shell use and archive operations.

Install this if you want a structured long-form writing workflow and are comfortable letting it create many project files and archives. Confirm archive or reverse-merge prompts carefully, because reverse-merge can overwrite files under `在编辑稿/`.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill declares a strict safety boundary that all edits must occur only under `在编辑稿/`, but the workflow then instructs writing outputs to multiple paths outside that directory such as `01-story-premise.md`, `03-outline/...`, `06-validation/...`, and `references/characters/`. This inconsistency can cause an agent to modify files outside the intended sandbox, undermining user expectations and any policy that relies on `在编辑稿/` as the sole writable area.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The document title and all procedural instructions are written in Chinese, and nowhere in the file is there an option for the user to select another language or locale. Under the policy, a skill that effectively mandates a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly justified as region-specific.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The document says archive versions are read-only, but the archive process also describes generating new files inside each archive version directory. While likely intended as a one-time creation step before the archive becomes immutable, the current wording is ambiguous and may lead an agent to write into supposedly read-only archives after creation, weakening archive integrity.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The template explicitly requires Chinese-specific fonts (`PingFang SC, Microsoft YaHei`) for the generated HTML output. This imposes a specific language/locale presentation by default, and the document does not state that users may choose another language or locale.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown template forces a specific language/locale for all headings and instructions, and there is no indication that users may choose another language. Under the stated policy, language constraints should either be optional or explicitly justified.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese and does not indicate that the language is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.