xt-webnovel-writing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This is a coherent Chinese webnovel-writing skill, but it needs Review because it defaults to broad local project persistence and has weak path-containment guidance for file writes.

Install only if you want a Chinese webnovel project manager that can create and update a structured local project tree. Before using project mode, choose an explicit project_root, review every planned write/delete path, avoid copying the strict rules into global settings unless you want them to apply broadly, and do not use untrusted character names, arc slugs, or index files without stronger path validation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:344

Finding

Project Root Escape Through Unsanitized Character and Arc Paths

Content

View full analysis

/characters/.md` - STEP 4 大纲 → 按 L1–L5 层级分解为多个 `/arcs/arc--.md` ``` The persistence protocol also instructs the Agent to use these dynamic paths without requiring safe-basename validation: ```text ### STEP 6 · 更新人物卡 1. 对 `characters_present` 每个角色： - 打开 `characters/.md` 2. 对 `new_characters`： - 新建 `characters/.md` ``` The read protocol trusts character paths obtained from a project index: ```text 1. 从 Phase 3 拿到 `characters` 列表 2. 读 `characters/_index.md` 定位文件路径 3. 每个角色读 frontmatter + "当前修为" + "最近状态" ``` ### Technical Analysis The validation uses `path.startswith(project_root + "/")`, which checks the textual representation of a path rather than its normalized or canonical destination. A path such as: ```text /characters/../../outside/target.md ``` starts with the expected project-root prefix and has `characters` as its first component, but filesystem normalization resolves it outside `project_root`. No documented validation rejects: - `..` or `.` path components - Forward or backw ...[truncated 2314 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full-featured Chinese web-novel generation orchestrator with rich workflow, persistence, structural file management, module routing, and hard-gate quality enforcement. The supplied code chunk is instead a narrow 'two-phase guard' hook. It watches for specific command events (new/reset/stop) and outgoing message text, then appends advisory reminders about loading plans, running verification, and avoiding finalization claims before self-checks. This is related at most as a supporting workflow safeguard for chapter-writing, but it does not itself perform the primary declared functions. The mismatch is material because the actual code's purpose is a lightweight heuristic reminder layer, not the comprehensive writing agent described.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

本 skill 是一个**完整的中文网文写作 agent 包**。整个仓库是一个 OpenClaw skill，根 `SKILL.md` 是唯一入口；6 个 `webnovel-*/workflow.md` 是**内部模块**（按需加载，不是独立 skill）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

├── webnovel-pitfalls/workflow.md

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises a very broad set of trigger phrases and applicability conditions, which can cause the diagnostic workflow to activate on loosely related requests. In an agent routing context, overbroad activation is dangerous because it can hijack user intent, invoke unintended file reads or analysis steps, and increase the chance of cross-skill misuse or denial of normal task completion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that all copy, templates, and deliverables default to fully Chinese. This is a natural-language locale constraint presented as a default behavior, but the document does not clearly offer the user a language choice or explicit opt-in at that point.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Manifest 顶部描述在 L003 将允许的固定子目录列为 book.yaml、fingerprint.md、bible、characters、arcs、chapters、state、index、.webnovel-memory，并强调“禁止散落”。但正文流程与目录契约在 L108-L119、L302-L306、L335 明确要求把全书规划写入 <project_root>/全书企划/，这属于实际设计行为与顶层描述不一致。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad natural-language phrases such as generic writing or continuation requests, which can cause the skill to activate in contexts the user did not intend. In an agent environment with file-writing and shell-adjacent tooling, accidental invocation can lead to unintended file creation, project initialization, or workflow side effects on unrelated conversations or repositories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file explicitly states “全中文” as an output requirement, forcing a specific language for all outputs. This is a natural-language policy concern because the skill does not provide user opt-in, language selection, or a documented region/compliance justification for restricting output language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The regexes and user-facing messages rely on Chinese phrases such as '定稿', '已落盘', and the guidance text is entirely in Chinese. This effectively enforces a specific language/locale for activation and compliance checks, with no opt-in or alternative language path documented in the file.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · hooks/two-phase-guard/handler.ts (reported line 32)May include surrounding context.

ts

return;
  }

  // Stop reminder to avoid finishing without verification.
  if (event.type === "command" && event.action === "stop") {
    pushMessage(
      event,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document is framed as mandatory rules for generating '中文网文' and all guidance is written to enforce Chinese-language webnovel generation. There is no indication that language choice is optional or user-selected, nor any documented region-specific justification for this language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file title and entire instructional content are presented exclusively in Chinese, with no indication that alternative languages are supported or that the language constraint is optional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L30 states that project *.md documents default to Chinese, and the same requirement is repeated in the short version at L72. This is a language-policy constraint imposed by default rather than offering the user a language choice or documenting a justified locale limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file mandates executing PERSIST and synchronizing project planning files once internal checks pass, but it does not require an explicit user confirmation immediately before modifying files. In an agent skill, this creates a real risk of unauthorized workspace writes, especially because the instructions normalize automatic stateful file updates as part of ordinary content generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L72 repeats the default-Chinese requirement for project markdown documents. Because the rule is presented as mandatory behavior and does not provide a user language choice, it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The rule forces all generated and written Markdown documents to default to Chinese, except for narrow allowlisted cases, without requiring user opt-in. This creates a policy-level constraint that can override user language preferences and may cause unauthorized transformation or exclusion of content in multilingual workflows, which is a genuine safety and compliance issue even if it is framed as a formatting standard.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The embedded short-rule block repeats the same mandatory Chinese output requirement, reinforcing the behavior across copied global rules and increasing the chance that downstream agents will apply it automatically. Because this shorter block is designed for broad reuse, it can propagate the restriction beyond the immediate skill and more consistently override user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad terms such as 改文笔, 描写, polish, and rewrite, which can match generic editing requests outside the intended webnovel scope. This can cause the skill to activate unexpectedly and apply its file-writing and rewrite behaviors in unrelated contexts, increasing the chance of unintended processing or downstream unsafe actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow directs project-mode rewrites to write back to memory and fixed directories, but it does not require explicit user notice or consent before persisting content. In an agent setting, silent writes can modify project files or store user content unexpectedly, creating integrity and privacy risks even if writes are constrained under project_root.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delivery checklist enforces strict output paths for project writes but still omits a mandatory confirmation and disclosure step before those writes occur. This makes unauthorized or surprising file modifications more likely, especially because the skill is designed to operate across chapter, state, and memory files within a project.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and all schema examples are presented in Chinese, and the schema names core directories and content fields in Chinese as the required project structure. Because the file says all project writing must follow this fixed directory layout, it effectively imposes a specific language/locale convention rather than offering a user choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file title and all operational instructions are written as mandatory Chinese-only protocol text, including requirements that downstream skills must execute before generating chapters. There is no indication that users may choose another language or that the locale restriction is explicitly justified as a region-specific requirement, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This protocol authorizes extensive state-changing filesystem operations across a project tree, including creating and overwriting many files, deleting chapter artifacts, clearing stale locks, and performing rollback actions, but it does not require explicit user confirmation, dry-run preview, or strong safety interlocks at the point of execution. In an agent setting, that creates a real risk of unintended data loss, destructive writes, or corruption of project state if the agent is mistaken, manipulated by prompt input, or operating on the wrong project_root.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file defines activation conditions, and the description says the system is '默认用于任何需要跨上下文窗口保持…的项目型写作' while also listing broad trigger terms such as '记忆', '项目', '续写', and '接着写'. These phrases overlap with common writing requests and the default-use wording does not clearly constrain when the skill should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This workflow explicitly requires persistent storage of project content across sessions and positions disk as long-term memory by default for project writing. If users include sensitive material in drafts, notes, or character/world data, the system will retain and later reuse that information, increasing the chance of unintended disclosure through later prompts, summaries, or cross-session resurfacing.

Content

No source excerpt is available for this finding.