Security audit

story-long-analyze

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real novel-analysis skill, but it needs Review because it persistently stores source text and can modify a related decision file outside its advertised output folder.

Install only in a workspace where you are comfortable storing a full copy of the novel and extracted original-text excerpts. Before running it, confirm you have rights to the source text, watch for creation of 拆文库/{书名}/原文/ and 文风.md, and review or disable the optional 选题决策.md backfill if you do not want the skill editing files outside the analysis output folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs searching up to the parent directory and modifying a discovered `选题决策.md` outside the declared output tree. That exceeds the stated scope of a novel-analysis skill and creates a cross-workspace integrity risk: the agent may alter unrelated project files based on loose filename matching and user confirmation flows. The context makes this more dangerous because the same skill otherwise frames all outputs as confined to `拆文库/{书名}/`, so operators may not expect writes elsewhere.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest and description state that outputs are written under `拆文库/{书名}/`, but the body later permits writing to external decision files outside that directory. This mismatch is a real security issue because it defeats user expectations and review controls that rely on the declared output boundary, enabling unexpected file modification. In context, hidden scope expansion is especially risky for agent skills because users often grant broad file access based on the manifest summary.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The protocol explicitly directs the system to copy 4–6 substantial 300–500 character original-text excerpts into `文风.md` and labels them as example fragments for downstream writing. In context, this goes beyond analysis and turns copyrighted source text into reusable generation material, materially increasing the chance of style imitation that is too close to the original and of unauthorized storage/redistribution of protected text.

Vague Triggers

High

Confidence: 88% confidence
Finding: The trigger list includes broad natural-language phrases such as '帮我拆这本书', '拆这本书', and path-based activation, which can match ordinary conversation and unintentionally launch a long-running pipeline. Because this skill copies source material, writes many files, and may continue into multi-stage processing, accidental invocation can cause significant unintended data processing and filesystem changes. The context increases severity because activation is tied to a heavy, stateful workflow rather than a harmless read-only action.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown requires copying sizable original passages for later use in writing, but provides no warning, consent check, or copyright guardrail. That creates a concrete risk of retaining and reusing protected text in derivative generation workflows, which can expose operators to copyright, policy, and data-handling issues.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill requires copying the full user-provided original text into `拆文库/{书名}/原文/` and preserving pasted text as `原文.md`. Even if intended for resumability and auditability, this is a real data-retention risk: full source content may contain copyrighted, sensitive, or private material and remains on disk beyond the immediate task. The skill context partially justifies temporary local processing, but mandatory persistent backup of complete originals is broader than necessary for analysis output.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.