Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese long-novel analysis workflow that reads a user-supplied book project and writes analysis artifacts, with no evidence of hidden exfiltration, persistence, or destructive behavior.
Install only if you are comfortable letting the skill read the selected novel/project files and write analysis outputs under the book workspace, plus optional inspiration-library and topic-decision updates. Before reruns or chapter-index rebuilds, confirm the target directory because some documented maintenance steps move old outputs or require deleting generated summaries/caches.
描述声称该技能是面向网文内容的深度拆解与分析工具，但代码是一个纯机械性的 chapter index builder。它读取源文本，解析章节标题格式，验证编号连续性，处理目录/重复标题/序章折叠，输出CSV索引，并在重建时比较旧索引与哈希，确保章节映射稳定。文件头注释还明确说明“never writes analysis progress and never interprets story semantics”。因此其主要目的与声明严重不符：声明的是语义分析与创作辅助管道，代码实现的是底层预处理/索引基础设施。虽然“兼容旧成果、断点续跑”的一部分基础能力可被索引重建间接支持，但这不足以覆盖声明中的核心分析能力，因此应判定为明显不匹配。
声明描述的是一个面向小说内容的长篇拆文分析技能，而代码仅实现对既有分析资产的静态检查与状态判定。它读取 _progress.md、chapter_index.csv、章节/、剧情/、角色/、设定/ 等目录下的文件，判断覆盖率、完整性、旧版/新版章节映射冲突、可直接复用或需修复的阶段，并输出 inspection JSON。代码中没有对小说正文进行解析分析，也没有生成逐章摘要、黄金三章分析、剧情结构、情绪节奏、角色设定或文风接口内容。虽然声明中提到“兼容旧成果直接使用、按需增强和断点续跑”，这与代码的资产检查有一定关联，但这只是整个声明中的辅助能力；代码缺失了声明中的核心主功能，因此属于明显描述与行为不匹配。
虽然声明中提到“含可选三层灵感库管道”，但这段代码只覆盖该管道中的底层机械维护部分，且没有实现所宣称的长篇小说拆文主能力。代码核心是：从 情绪模块.md 提取 EM 卡，做字段完整性与专名泄漏检查，生成/更新 灵感索引.csv，校验 IA/NM/CBA 关系、标签词表和计数一致性，并提供 coverage/query/resolve 等索引检索能力。因此它的实际主用途是灵感库索引管理与验证，不是用户所描述的“拆文分析”技能本体。该差异属于主目的偏离和未声明的重要能力（文件索引维护/查询），应判定为描述与行为不匹配。
声明描述的是一个综合性的长篇网文分析技能，而提供的代码仅负责把已有的人物关系表转换为 Markdown/Mermaid 和可选 PNG 图表。它不读取小说正文进行拆解，不生成章节摘要，也不进行剧情、情绪、节奏、设定、文风或灵感库分析。虽然“关系分析”在声明中被提到，但这里的代码只是一个配套的可视化导出工具，主目的与声明的主能力明显不同，因此构成实质性不匹配。
The skill instructs the agent to use shell execution and read/write files, but the manifest does not declare any tool scope such as allowed-tools or permissions. That creates an overprivileged execution surface where a host may permit broader filesystem or command access than the skill actually needs, making accidental misuse or abuse harder to contain.
The trigger phrases are broad natural-language requests like '帮我拆这本书' and '深度拆解', which overlap with ordinary user conversation and can cause the skill to activate unexpectedly. In a skill that can read files, write outputs, and invoke shell-backed workflows, overbroad activation increases the chance of unintended processing of local content or execution of file-manipulating routines.
Line L003 states that dialogue replies and written output files must all follow this file, and the entire file prescribes Chinese-language phrasing throughout. This imposes a specific language/locale behavior on the skill without any visible user opt-in or alternative language option, which is a natural-language policy concern.
This markdown file presents all user-facing instructions exclusively in Chinese, including the title and operational checklist. Because there is no opt-in, fallback, or language-selection guidance, it may violate a language/locale policy requiring user choice rather than forcing a single language.
L07 tells the user to delete chapter summaries and cache files to force regeneration, but it does not explicitly warn that deleting the wrong files could remove prior outputs or require recomputation. Under the markdown-file criteria, this is a user-data-affecting behavior that should include a clear warning.
L14-L17 direct the user to move many generated artifacts into a legacy directory and to delete chapter_index.csv, which changes the workspace state and can affect downstream processing. The instructions explain what to do, but they do not explicitly warn the user about the impact on existing outputs or advise verifying the target path before proceeding.
The entire skill specification is written as mandatory Chinese-language instructions and names, with no indication that users may choose another language or locale. This creates a natural-language locale constraint that is not documented as optional or region-specific, which matches the policy-violation criterion for forced language without user opt-in.
该文件的自然语言指令明确要求按特定中文文档向作者转述，整体内容也默认以中文进行交互，但没有提供用户语言偏好选择或显式的中文限定说明。根据规则，强制特定语言而无用户选择属于自然语言政策问题。
This markdown file contains user-facing instructions exclusively in Chinese, and there is no visible opt-in, alternative language option, or explanation that the skill is region-specific. Under the language/locale policy rule, forcing a specific language without user choice is a natural-language policy concern.
The file’s natural-language instructions, field labels, examples, and required output format are entirely specified in Chinese, including exact required strings such as section headers and labels. There is no indication that the user may choose another language or opt in to this locale constraint, which can violate a language/locale policy for broadly applicable skills.
The entire skill instruction set is written as mandatory Chinese-language guidance, with no indication that users may choose another language or locale. Under the policy, a skill that effectively enforces a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The file’s operational instructions and required artifact names are entirely specified in Chinese, effectively constraining the skill’s interaction and outputs to a single language. The document does not offer an opt-in choice of language or explain that the skill is intentionally limited to a Chinese-only regional or compliance context.
The file’s natural-language instructions, field names, and required output conventions are entirely in Chinese, and it does not indicate that the user or operator may choose another language. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless the restriction is clearly justified as region-specific.
This Python file includes natural-language instructions and operational messages entirely in Chinese, including the module description and many emitted error strings. For a general-purpose skill, this effectively imposes a specific language/locale on users without offering a choice or documenting that the tool is region-specific.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
candidates = [path for name in CJK_FONT_NAMES for path in by_name.get(name, [])]
if shutil.which("fc-list"):
try:
listed = subprocess.run(["fc-list", ":lang=zh", "file"], capture_output=True, text=True,
timeout=10, check=False).stdout
except (OSError, subprocess.SubprocessError):
listed = ""
No suspicious patterns detected.