story-setup

• Outcome: Review
• Latest audit: Sep 9, 2026 · 10:09 AM UTC
• Version: 1.1.23

Overview

This is a coherent setup skill for a web-fiction writing toolkit, but it installs persistent project hooks and agents that users should knowingly opt into.

Install this only in writing projects where you want the toolkit to add persistent project hooks, custom agents, routing files, and optional browser-assisted research. Review the selected target CLI before deployment, avoid invoking browser-cdp against sensitive logged-in sessions unless you intend that access, and set STORY_NO_UPDATE_CHECK=1 if automatic GitHub update checks are not acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill performs broad file reads/writes and shell/script execution across project and agent configuration directories, but it does not declare permissions or clearly bound those capabilities in metadata. That creates a transparency and review gap: users or hosting platforms may invoke a skill with far more power than its manifest suggests, increasing the risk of unintended configuration changes or abuse if the package is compromised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose says this is an infrastructure deployment/check skill, but the documented behavior also installs and enables runtime hooks that intercept writes, scan content, inject session context, and influence future agent execution. That mismatch can cause users to authorize what appears to be setup work while actually granting persistent behavioral control over their workspace and agent runtime.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The subagent is a narrative-writing helper, but it is explicitly allowed to invoke shell commands. That expands its capability from text processing into arbitrary local command execution, which creates unnecessary attack surface if the prompt, project files, or referenced content are adversarial or prompt-injecting.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The agent is instructed to run local scripts such as `check-ai-patterns.js` and `check-outline-copy.js`, which means a writing-oriented subagent executes repository-provided code. If those scripts are modified maliciously, or if the repo is untrusted, this becomes an arbitrary code execution path under the agent's permissions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly says it must not modify existing files, yet the declared permissions include general edit capability and the workflow writes into a user-supplied project directory. That mismatch weakens enforcement: if the agent or caller is confused, it can overwrite or alter arbitrary files in the project rather than only creating a new reference file.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This command file belongs to the story-setup skill context, but it instructs the agent to invoke a different skill, story-import. That mismatch can cause unintended capability routing, confuse permission/review boundaries, and let a user trigger behavior outside the declared purpose of the installed skill bundle.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The command file is materially inconsistent with the skill’s declared purpose: instead of environment setup or infrastructure checking, it invokes a short-story analysis workflow. In an agentic system, this kind of capability/intent mismatch can cause the wrong tool to run under trusted setup-related triggers, leading to unintended actions, policy bypass through misrouting, or user deception about what the skill actually does.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The session-start hook performs an outbound network request to GitHub during routine startup, but the skill metadata/description presented here focuses on deployment and environment checks and does not clearly disclose that each session may contact a remote service. Even though the request only checks release metadata and is rate-limited/cached, it still creates an implicit telemetry surface and can surprise users in restricted or privacy-sensitive environments.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The patch installs persistent process hooks for Bash and file modification events, causing arbitrary local Node code to run before and after common tool actions. For a skill described as environment setup/checking, this exceeds the minimally necessary scope and creates an ongoing interception point that can influence or inspect user actions across the session.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file enables runtime behavior modification through SessionStart, PreToolUse, and PostToolUse hooks even though the skill metadata presents the feature as setup/checking infrastructure. This mismatch reduces transparency and can mislead users into accepting persistent execution hooks that monitor or alter later agent behavior, increasing the risk of abuse if the referenced script is changed or behaves unexpectedly.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The `always_on` trigger causes this rule file to be loaded in every context, not just when the user intends to use the writing setup workflow. That broad activation can misroute tasks, force unsolicited file reads, and expand the skill's influence across unrelated conversations, increasing the chance of unsafe or privacy-impacting behavior.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The AGENTS template advertises that natural-language phrases can directly trigger skills, which increases the chance of accidental or prompt-injected invocation when a user is merely discussing setup rather than intentionally executing it. In this skill context, the triggered capability performs environment deployment and hook/agent installation, so unintended activation can change project configuration or prepare trusted execution paths.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The router skill explicitly supports fuzzy-intent automatic dispatch for a broad 'story' entrypoint, which creates a larger prompt-injection and misrouting surface than direct command invocation. In this repository, that matters more because the routed skills include environment setup and browser-related capabilities, so an ambiguous request could be escalated into configuration changes or tool use the user did not clearly intend.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The agent is declared as routable from multiple higher-level story skills, but the file does not define strong activation boundaries, disallowed cases, or a narrow input contract beyond broad research use. In an agentic system, this increases the chance of unintended invocation, over-collection of external data, or use in contexts where browsing and file creation were not expected by the user.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The routing table maps very broad, natural-language intents such as '准备写书', '部署', and other generic writing-related phrases to powerful skills. In agents that auto-route based on fuzzy matching, this can cause unintended invocation of adjacent capabilities, especially because the same file also advertises skills with write, import, review, and browser-related effects. The context makes this more dangerous because this AGENTS template is explicitly designed for generic agents and Web AI platforms where hard hooks and interception may be absent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file advertises 'browser-cdp' for browser control and 'story-import' for importing existing novels, but does not present clear user-facing warnings, consent requirements, or data-handling constraints near those entries. In a generic agent environment, this omission can lead users or downstream agents to invoke capabilities that access logged-in browser state or ingest local/private content without understanding privacy and integrity risks. The skill context increases risk because the document is explicitly intended as an execution entrypoint for platforms lacking built-in hooks or hard runtime safeguards.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The template explicitly encourages invoking skills via natural-language naming when direct commands are unavailable, which increases the chance that ordinary user requests are interpreted as tool-execution intents. In an agent ecosystem, ambiguous routing can trigger setup or file-manipulating behavior without sufficiently explicit user consent, especially because this skill is an environment/deployment entrypoint rather than a read-only helper.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The routing table lists multiple broad intent aliases, including generic phrases like writing, review, import, and setup-related expressions, which can cause accidental or adversarial prompt steering into the wrong skill. Because these skills appear to perform workflow actions across project files and environment setup, overly generic triggers widen the attack surface for unintended invocation and cross-skill confusion.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The command aliases include natural-language triggers such as “准备写书”, which can plausibly appear in ordinary conversation and cause unintended skill routing. In an agent framework, accidental invocation can lead to unexpected file reads, environment setup actions, or context changes without the user intending to call this specific skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to write a Markdown file into the local project directory without requiring explicit user disclosure or confirmation at the time of modification. In practice, this can surprise users, create persistence on disk, and be abused by an untrusted caller to drop files into attacker-chosen locations if project_dir is not tightly validated.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation text simply tells the system to use the story-short-analyze skill without any scope checks or conditions, making activation easier in contexts where the user did not clearly request this specific behavior. Because the surrounding skill is supposed to be for writing-environment setup, the broad trigger increases the chance of incorrect tool selection and unintended prompt routing.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The command description and body instruct the agent to 'automatically route' based on vague user intent, which increases the chance of unintended skill invocation or misrouting to more powerful tooling than the user explicitly requested. In an agent ecosystem, fuzzy dispatch is risky because it can expand scope, trigger side effects unexpectedly, and make authorization boundaries less clear.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The entry '模糊意图自动分发' explicitly advertises fuzzy intent-based dispatch, which can cause the wrong skill to be selected from broad user phrasing. In a multi-skill environment that includes setup, browser control, import, and review functions, misrouting can lead to unintended file changes, data access, or use of more powerful tooling than the user intended.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The `/story` and `/网文` commands are defined as a fuzzy-intent auto-router, which broadens activation conditions and can cause the wrong skill to trigger from ambiguous user input. In an agent environment that routes commands automatically, this increases the chance of unintended actions or bypass of more explicit user consent boundaries.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This hook issues a curl request to api.github.com from a session-start path without prominent disclosure in the file header or user-facing setup flow. The behavior is not inherently malicious, but silent network access at session start can violate least surprise, leak timing/IP metadata, and cause policy issues on locked-down systems.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: references/opencode/plugin.ts:24