Security audit
Security checks for vulnerabilities and agentic risk
This Chinese novel-import skill creates and updates local story project files as disclosed, with no evidence of hidden network access, credential use, system persistence, or destructive behavior.
Install this only for a Chinese-language story project where you expect the agent to create and update many local project files. Keep a backup or use version control before importing, because the skill can migrate content, archive old analysis outputs, initialize tracking state, and change .active-book within the workspace.
The skill description presents the behavior as a novel-import workflow, but the specification also includes undeclared state management, tracking generation, file writes, and script execution. Hidden or underdocumented side effects are security-relevant because users may authorize a seemingly narrow content-import task without realizing it can mutate project state broadly and run auxiliary tooling.
The skill description presents the behavior as a novel-import workflow, but the specification also includes undeclared state management, tracking generation, file writes, and script execution. Hidden or underdocumented side effects are security-relevant because users may authorize a seemingly narrow content-import task without realizing it can mutate project state broadly and run auxiliary tooling.
The skill description presents the behavior as a novel-import workflow, but the specification also includes undeclared state management, tracking generation, file writes, and script execution. Hidden or underdocumented side effects are security-relevant because users may authorize a seemingly narrow content-import task without realizing it can mutate project state broadly and run auxiliary tooling.
Referenced artifact was not completely inspected
读 [import-tracking.md](references/import-tracking.md)，用本 skill 自带的 `scripts/tracking_commit.py init` 一次性生成 `追踪/`，`check` 通过后勾进度。
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json
The skill explicitly instructs the agent to read and write project files, create directories, and invoke a Python tracking script, but it does not declare any tool scope or allowed-tools boundary. That creates an authorization ambiguity where a caller may trigger broad filesystem and shell-capable behavior without clear least-privilege constraints or user-visible permission limits.
The trigger phrases include very broad natural-language terms like '导入' and '反向解析', which can cause accidental activation in unrelated conversations. Because this skill can write files, create project structure, and potentially invoke other analysis flows or scripts, overbroad activation materially increases the risk of unintended state changes.
The file’s natural-language instructions, examples, and checklist are entirely in Chinese, and there is no indication that users may choose another language or that the skill is restricted to a Chinese-only context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The instruction says that when prior short-story outputs are not reusable, the agent should archive existing outputs and rerun from Stage 2, explicitly without asking the author. That creates a real safety issue because it permits state-changing file operations on user project data without confirmation, which can lead to unintended overwrite, confusion, or loss of work if the source matching or retry logic is wrong.
The file includes fixed Chinese response wording and requires the agent to reply with a specific phrase rather than adapting to the user's language preference. This is not directly a security flaw, but it is a genuine policy/control issue because it can override user intent, reduce clarity during routing or recovery, and increase the chance that the user misunderstands a state-changing action.
The document is written as a normative specification for output structure and states it defines the default delivery format, but it does so entirely in Chinese and does not indicate that language choice is optional or user-selectable. This can violate language/locale policy because it effectively fixes the skill's behavior to a specific language context without explicit opt-in or a documented region-specific justification.
L03 states that Phase 5 only reads this file and the import record, implying a read-only reporting step. However, later in the same document Step 3 instructs the agent to set .active-book and tick the import record, which are state-changing writes outside a purely read-only phase.
The line says '只读本文件和导入记录', which directly communicates no modification behavior during this phase. That conflicts with L62, where the procedure tells the agent to update .active-book and mark progress in the import record, so the documentation contradicts the actual instructed behavior.
The entire skill file is written in Chinese and presents operational instructions only in Chinese, with no indication that users may choose another language or locale. This can violate a language-choice policy when the skill is used in broader contexts without explicit user opt-in to Chinese.
The file is entirely written as mandatory operating instructions in Chinese, including prescribed file and directory names such as 追踪/, 上下文.md, and 作者真相.md, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The skill instructions prescribe exact Chinese prompts to use with the user, such as asking "这是长篇还是短篇？", and the entire routing flow is written to operate in Chinese only. There is no indication that the user may choose another language or that the Chinese-only constraint is intentionally limited to a justified region-specific workflow.
The entire document prescribes the skill's rules and template in Chinese, including required output fields and phrasing, but it does not state that the skill is specifically limited to Chinese-language content or provide any opt-in for language selection. This creates a natural-language locale constraint that could violate organizational language-choice policy if applied to general users.
The file's natural-language instructions and examples are fully Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The file title and all operational instructions are written entirely in Chinese, and the workflow language is implicitly fixed throughout the skill. There is no natural-language indication that users may choose another language or that the Chinese-only constraint is intentional for a region-specific or language-specific use case.
The title and operational instructions are entirely written as Chinese-only workflow requirements, and the file gives no indication that users may choose another language or that the restriction is region-specific. This creates a natural-language locale policy concern because the skill appears to enforce a specific language by default.
This markdown file presents all operational instructions, constraints, and examples exclusively in Chinese. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific context, which can amount to forcing a specific language without user opt-in.
The file’s natural-language description and usage instructions are written to operate specifically on Chinese-language outline fields such as “细纲路径”, “核心事件”, and “[待补充]”, without offering any language or locale choice. This constitutes a locale/language constraint expressed in natural language that is not documented as optional or user-selectable.
This Python skill hard-codes Chinese headings, statuses, prompts, and output formats, indicating the tool operates only in Chinese. The file does not offer a language/locale option or explain that the locale restriction is required for a region-specific workflow, which matches the policy category for forced language without opt-in.
Detected: suspicious.dynamic_code_execution