T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/v2/writing_loop.py:548- Finding
Manual confirmation does not prevent unapproved model calls and persistent state changes
- Content
View full analysis
- Remediation
View remediation
Security audit
Fanfic Writer
Security checks for vulnerabilities and agentic risk
Overview
This novel-writing skill is mostly purpose-aligned, but it needs review because its promised manual approval gates are not actually enforced before model calls and persistent writes.
Install only if you are comfortable reviewing the code and running it in a dedicated novel workspace. Avoid auto mode and large chapter ranges, do not point --run-dir at sensitive directories, and assume manual mode may still make model calls and write files before you approve the generated content.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/v2/openclaw_entry.py:204- Finding
Unbounded chapter ranges can cause memory exhaustion and uncontrolled model expenditure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (96)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
Auto-rescue, auto-abort state changes, automatic merge, and backpatch closure reduce or bypass expected human review if they are performed without clear approval boundaries. Even in a writing skill, automatic mutation of state and generated outputs can lead to silent content changes and make it harder for users to detect unintended or manipulated results.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python - 对话风格指引 - 卡点/高潮安排 """ return prompt def write_chapter_segment(chapter_title, segment_num, total_segments, previous_content, detailed_outline_segment,
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The code enumerates environment variables and filters by a broad FANFIC_ prefix before writing them into generated runtime config. Prefix-based harvesting is dangerous because teams commonly place credentials in environment variables; once persisted, those values may be exposed to other users, plugins, logs, artifacts, or source-controlled output directories.
- Content
python rt_mgr = RuntimeConfigManager(run_dir) rt_mgr.generate( cli_args={k: v for k, v in kwargs.items() if v is not None}, env_vars={k: v for k, v in os.environ.items() if k.startswith('FANFIC_')}, config_file={'mode': config['generation']['mode'], 'model': config['generation']['model']}, defaults={'max_attempts': 3, 'auto_threshold': 85}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide instructs users to run write/finalize workflows against a user-supplied --run-dir and describes a file structure with many generated state, draft, log, archive, and final-output files, but it does not warn that these commands can create and modify substantial content under the chosen path. This is dangerous because users may point the tool at an unexpected or sensitive directory and trigger broad writes, overwrites, or storage growth without realizing the scope.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # 检查目录结构 ls -la ~/.openclaw/skills/fanfic-writer/ # 重启 OpenClaw openclaw restart
Static analysis
No suspicious patterns detected.