story-long-write：长篇网文写作

• Outcome: Review
• Latest audit: Oct 18, 2026 · 1:50 AM UTC
• Version: 1.1.42

Overview

This skill is a Chinese long-form fiction writing assistant that clearly uses local project files, helper scripts, and optional subagents to plan, write, revise, and track novels.

Install this only for workspaces where you are comfortable letting a writing assistant create and modify novel project files, maintain .story tracking state, run bundled Python/Node quality tools, and store explicit writing preferences. Review generated changes before relying on them, especially revisions, author-memory updates, and any workflow that writes multiple chapters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (68)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding includes more than mere description mismatch: the skill can accept/reject chapter submissions, apply tracking transactions, modify project state, write transaction JSON, and delete working directories while also invoking external runtimes/scripts. In a writing assistant, these are sensitive state-mutating operations; when combined with undeclared broad tool access and many automatic workflow branches, they increase the chance of destructive or unintended workspace changes.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

所有追踪写入都走 `scripts/tracking_commit.py`：`追踪/_tracking-state.json` 是唯一权威，`上下文.md`、角色快照、`伏笔.md`、时间线都由它派生，禁止手改。体积上限由脚本检查、超限一次报全；字段与上限见 [tracking-transaction.md](refe

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/tracking-transaction.md (reported line 24)May include surrounding context.

{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/tracking-transaction.md (reported line 25)May include surrounding context.

{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/tracking-transaction.md (reported line 26)May include surrounding context.

{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/build_writer_prompt.py (reported line 622)May include surrounding context.

python

prompt = "\n\n".join(parts) + "\n"

    return prompt, []


def main(argv=None):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs the agent to read, write, and invoke shell/Python scripts across the workspace, but the manifest does not declare any explicit tool scope or allowed-tools boundary. That creates an unnecessary privilege gap: a writing skill can perform filesystem and command execution actions without a machine-readable least-privilege constraint, increasing the risk of unintended file modification or abuse if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad everyday phrases such as '继续写', '续写', '修改第X章', and similar natural-language prompts that can be used in ordinary conversation. Because this skill has file-write and shell-oriented workflow behavior, overbroad activation increases the risk of accidental invocation, causing unintended file reads, state changes, or workflow execution when the user did not intend to run the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written as mandatory operational guidance in Chinese, with no indication that the user may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file mandates exact reply wording and examples entirely in Chinese, including fixed response phrases and formatting for user-facing receipts. This creates a language/locale constraint without any opt-in or alternative language path, which matches the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill document is written exclusively in Chinese and provides no indication that users may choose another language or that the file is intended only for a justified Chinese-language context. Under the stated policy, a forced language/locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill is written as a Chinese-only workflow specification, with required file names, prompts, and error messages in Chinese, and it does not offer any language choice or opt-in. Under the policy rule, forcing a specific language or locale without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L045 instructs users to follow official names/translations and to avoid mixing language families within the same region, which imposes a specific language/locale policy on output. The file does not present this as optional or user-configurable, and the rule is repeated later as a general requirement rather than a context-specific suggestion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L068 requires background and new supporting characters in existing settings to follow the original region's naming style and forbids mixing language families. This is a natural-language locale constraint presented as a mandatory rule, with no opt-in or alternate localization option for the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written exclusively in Chinese and does not indicate that the user may choose another language or that the skill is intended only for a Chinese-language audience. Under the language/locale policy rule, content that implicitly forces one language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill forces a specific language for all instructions and examples, which can violate language/locale policy when no user opt-in or justification is provided. The document does not indicate that the skill is region-specific or that alternative languages are supported.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown skill guidance is written exclusively in Chinese from the title onward and does not indicate that other languages are supported or that the user can choose their preferred language. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/storyctl.py:24

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/tracking_commit.py:37