短篇网文写作-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.1

Overview

This story-writing skill is not clearly malicious, but it asks agents to run a missing local Python script, which could execute the wrong file from the working directory.

Review this skill before installing. Its writing features are ordinary, but do not let an agent run the documented short_story.py commands unless a trusted, reviewed script is actually present in a fixed skill-owned directory. Prefer using it only for text guidance and manually controlled file output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Unsafe Execution of a Missing Relative Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-54, SKILL.md:123-161, SKILL.md:170, SKILL.md:197, and SKILL.md:239-252
Vulnerability Type: Untrusted relative-path script execution and excessive tool permission
Risk Level: Medium

The Skill declares command-execution access and repeatedly instructs the Agent to execute short_story.py using a relative path. However, the audited project contains only SKILL.md; the referenced Python script is not included.

Relevant tool configuration from SKILL.md:51-54:

yaml

tools:
  - read
  - exec
  - write

Representative execution instructions from SKILL.md:239-252:

bash

python3 short_story.py --help

bash

python3 short_story.py write --structure structure.json --output story.md

Technical Analysis

Python resolves short_story.py relative to the process's current working directory when invoked in this form. Because the package does not provide the script or require execution from a verified Skill-owned directory, the actual file executed depends on the Agent's runtime environment.

If an attacker can place a file named short_story.py in the working directory, the documented command can execute that file. The problem is amplified by the Skill's declaration of the unrestricted exec tool, even though its stated story-generation functionality can be implemented through the Agent's built-in language model and constrained file-writing operations.

In a clean working directory, the commands fail because the script does not exist. This also creates a material discrepancy between the documented capabilities and the contents of the package.

Attack Path

1. An attacker obtains write access to, or influences the contents of, the directory from which the Agent runs the Skill.
2. The attacker creates a malicious file named short_story.py in that directory.
3. A user requests one of the documented story-generation ope ...[truncated 1298 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the exec permission if story generation can be performed using the built-in language model and constrained file-write operations.
2. Remove all instructions that invoke the nonexistent short_story.py file, or include a reviewed implementation in the Skill package.
3. If a script is required, resolve it from a fixed, trusted Skill installation directory rather than the current working directory.
4. Validate the resolved script path and ensure that it remains inside the expected Skill directory before execution.
5. Verify the packaged script's integrity using a trusted manifest or cryptographic digest before running it.
6. Invoke Python with a fully resolved absolute path to the verified script and pass arguments as a structured argument array rather than constructing shell command strings.
7. Restrict execution through sandboxing, minimal filesystem permissions, disabled network access where unnecessary, and an allowlist of permitted commands.
8. Add installation and startup checks that fail safely when required packaged files are absent, without searching the current directory or system path for substitutes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises local file management and includes write-oriented workflows, but it does not clearly warn users that local files may be created or modified. In combination with read/exec/write tools, this can lead to unexpected filesystem changes, overwriting user content, or exporting generated material without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says users can trigger the scenario through natural-language instructions without narrowing the allowed scope. Because the skill has powerful tools such as exec, read, and write, broad invocation language can cause accidental activation and execution on loosely related prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger section is malformed and ambiguous, so the agent may not have a clear boundary for when this skill should activate. In an agent environment, vague activation conditions can cause the skill to run in unrelated contexts, increasing the chance of unintended file access or command execution because the skill exposes read/exec/write capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The visible display name, summary, and the full instructional content are presented only in Chinese, with no indication that users may choose another language. If organizational policy requires avoiding forced language selection without opt-in, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.