Security audit

story-review：多视角对抗式审查

Security checks for vulnerabilities and agentic risk

Overview

This story reviewer can also change your book’s saved continuity records without asking you to approve the changes.

Use /story-review solo to avoid automatic tracking changes; multi-batch reviews still save local progress. Before full/lean reviews, back up the book and require approval of proposed tracking changes. Keep --check when running the punctuation helper. Separately review deployed reviewer agents and companion writing tools.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied module is devoted to length compliance and record integrity, including default ±12% internal and ±15% user tolerance bands, author-specified ranges, and detection of changed chapter content or targets. Although word-count checks could support a broader story-review workflow, this chunk does not connect those checks to the declared review orchestration and has a materially different primary function. Its file reads are local; no network access, command execution, or file writes are shown. This assessment is limited to the supplied code chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied chunk implements a text-editing utility, not multi-agent review orchestration. Its primary behavior is to transform punctuation and write changed content back to disk unless --check is supplied. It contains no reviewer-agent spawning, full/lean review modes, solo fallback, rubric-based review, or handling of the declared review triggers. These are material purpose and capability differences, not merely supporting implementation details. This assessment is limited to the supplied code chunk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied script's primary purpose is transactional maintenance of a story project's tracking data. Functions such as initialize, apply_transaction, write_views, and archive_retired_tracking_paths perform substantial filesystem mutations, including updating 追踪/_tracking-state.json, generating derived Markdown, moving legacy files, and removing stale character snapshots. Those capabilities are not described by the declared review purpose. Although tracking updates could support a broader review workflow, this chunk implements a standalone state-management interface rather than the advertised adversarial review and agent-fallback behavior. No network access or data exfiltration is evident in the supplied code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The implementation centers on regular-expression and threshold-based style checks, including formulaic contrasts, cliché density, punctuation, paragraph length, and narrative connectivity. It does not implement the agent orchestration and fallback workflow emphasized by the description. Such a linter could support a broader story-review skill, but the supplied chunk alone has a materially different primary behavior. No file rewriting, network access, or agent spawning is visible; the imported whitelist module's internals were not supplied.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
node scripts/normalize-punctuation.js --check <正文文件...>

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
md
format` findings 合并进报告。`em-dash` 破折号只采用 `check-ai-patterns.js` 的语义改写建议（见下条）；`normalize-punctuation.js` 报的同一位置 `em-dash` 在合并时去重丢弃，避免同处出现「机械替换」与「按功能改写」两条相互冲突的 fin

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
node scripts/check-ai-patterns.js --check --fail-on=blocking <正文文件...>

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
md
le-hyphen`、`markdown-divider` 结果作为 `format` findings 合并进报告。`em-dash` 破折号只采用 `check-ai-patterns.js` 的语义改写建议（见下条）；`normalize-punctuation.js` 报的同一位置 `em-dash` 在合并时

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
- `check-ai-patterns.js` 的 blocking / advisory 都先作为 `prose` 候选，按 `style_resolution`、原文功能及三层方法逐条复核；确认造成具体阅读损失后，按下方严重度定义定级。功能性纠错、叙述与停顿保留，不把脚本级别直接换成必须修改的 finding。检

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
node scripts/check-degeneration.js --check <正文文件...>

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
- `check-degeneration.js` 报告模型退化（逐字复读/截断/占位符/工程词泄漏），每条带 `severity: blocking|advisory`：blocking（复读/截断/tier1 工程词）作为 S1/S2 `prose` findings，修复建议是「重新生成该段，不是改写」；advi

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/tracking-transaction.md (reported line 26)May include surrounding context.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py init --project {书项目根} --input {书项目根}/.story/work/init.json {PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/tracking-transaction.md (reported line 27)May include surrounding context.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py check --project {书项目根} {PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/tracking-transaction.md (reported line 28)May include surrounding context.
{PYTHON} {当前 skill 根}/scripts/tracking_commit.py draft --project {书项目根} --chapter {N} {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter check --project {书项目根} --chapter {N} [--min-chars {下限} --max-chars {上限}] {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter commit --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json {PYTHON} {story-long-write skill 根}/scripts/storyctl.py chapter accept-current-length --project {书项目根} --chapter {N} --input {书项目根}/.story/work/第{NNN}章/tracking.json

text
- `init`：只在 `_tracking-state.json` 不存在时执行，绝不覆盖已初始化项目。

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

The natural-language triggers “审查一下” and “帮我审一下” do not specify fiction review and can match unrelated review requests.

Medium

Category: Trigger Abuse
Confidence: 94% confidence
Finding: These phrases mean roughly “review this” and “help me review this,” and commonly apply to code, contracts, or other documents. Although the body describes a fiction-review workflow, the activation description does not require a fiction context or exclude unrelated reviews.
Content: No source excerpt is available for this finding.

Full/lean review automatically modifies project tracking files, a write-side effect not disclosed in the manifest.

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: A default full review can revise authoritative tracking state without separately obtaining permission to change project content. Although the body discloses and limits these writes, a request to review does not necessarily authorize persistent changes, and mistaken interpretations can contaminate future writing context.
Content: No source excerpt is available for this finding.

The review workflow instructs the agent to modify persistent story-tracking state, beyond the manifest's stated review scope.

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: This procedure turns review conclusions into persistent revisions of authoritative story state without an author-approval step. Evidence requirements, transaction checks, and solo-mode restrictions reduce risk but cannot prevent a semantically mistaken revision from influencing later chapters.
Content: No source excerpt is available for this finding.

The review skill instructs the agent to initialize and modify persistent novel-tracking state, beyond its declared review purpose.

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The manifest describes adversarial review with parallel reviewers and solo/rubric fallbacks. L07 instead directs the agent to write an initialization JSON file, run tracking_commit.py init, and delete the temporary file; L33 further specifies generating persistent tracking context. Initializing novel-production state is a separate workflow, not an obvious implementation requirement of reviewing a story.
Content: No source excerpt is available for this finding.

The review skill includes instructions for committing chapters and mutating persistent story-tracking state, beyond its stated review purpose.

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The manifest describes multi-perspective adversarial review with reviewer-agent and rubric fallbacks. These commands instead expose project initialization and chapter commit/acceptance workflows; L036–L042 specify persistent state updates and automatic deletion of chapter work directories after successful submission. Those publishing and state-management operations are not justified by the stated review capability.
Content: No source excerpt is available for this finding.

The review skill includes a normalizer that overwrites supplied manuscripts by default instead of only reporting review findings.

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The manifest describes adversarial review with reviewer-agent and rubric fallbacks, not automatic manuscript editing. Unless explicitly invoked with --check, this script writes normalized content back to each supplied file at L080–L081, including punctuation replacements and removal of divider lines; these persistent edits go beyond producing a review.
Content: No source excerpt is available for this finding.

The review skill exposes a story-state commit workflow that modifies authoritative project data, beyond the manifest's adversarial-review scope.

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The manifest describes multi-perspective review with reviewer-agent and rubric fallbacks, but this workflow merges supplied transactions into canonical story state, rewrites chapter records and derived views, and replaces _tracking-state.json. These are substantive project mutations rather than review findings: write_views also deletes character Markdown files absent from the new state (L1225–L1232), and the commit workflow is directly exposed through the CLI (L1697–L1698).
Content: No source excerpt is available for this finding.